Add authenticated RCE module for FreePBX filestore (CVE-2025-64328)

[Chocapikk]

Hello Metasploit Team,

This PR adds an authenticated remote code execution module for FreePBX filestore module (CVE-2025-64328).

The vulnerability exists in the SSH driver's testconnection functionality. The check_ssh_connect() function accepts user-controlled input for the SSH key path parameter, which is passed unsanitized to exec() calls when generating SSH keys, allowing command injection via shell command substitution syntax.

This vulnerability affects filestore module versions 17.0.2.36 through 17.0.2.44 (9 versions total). I verified the lower bound (17.0.2.36) by analyzing the git history - the vulnerable file was introduced in this version. Versions >= 17.0.2.36 && < 17.0.3 are affected, and 17.0.3 is patched (as per GHSA-vm9p-46mv-5xvw).

The module requires valid FreePBX credentials for a user account in the "Filestore" group (administrator or low-privilege user).

The module includes automatic version detection, support for both administrator and low-privilege users, and comprehensive documentation with Docker setup instructions.

Note: I also renamed the XorcomCompletePbx mixin to CompletePBX and updated the module name references in 3 Xorcom modules. I found this naming more consistent and cleaner.

Thanks