fix(yara): replace prose-colliding webshell strings with family markers (fixes #487) - #488

`php_webshell_known` matched the bare substrings "behinder" and "WSO "
under `any of them`, so ordinary prose produced a CRITICAL YR2 finding
at 0.9 confidence with a remediation telling the reader to remove a
webshell. The German words "behindert" and "Behinderung" contain the
first string, and the product name "WSO 2 Micro Integrator" contains
the second, as reported in NVIDIA#487.

Behinder is now identified by its hardcoded AES key, md5("rebeyond")
truncated to 16 characters, which its PHP, ASP and JSP shells share and
which signature-base [1] uses for the same purpose. The key is written
as a YARA hex string so the packaged rule file does not carry the
indicator in plaintext, in the spirit of the encoded malware rules. WSO is identified
by the helper names oRb introduced in 2.x: `wsoEx(`, `WSO_VERSION` and
`wsoSecParam`. I checked a WSO 2.5 source against the old and new rule:
the old one hit only the banner and the bare "WSO " string, the new one
hits the banner and all three helpers, so no known sample is lost.

I preferred narrowing the strings over a `fullword` modifier because a
document that names the Behinder family would still have scored
CRITICAL, and "WSO 2" would still have matched.

Fixes NVIDIA#487

[1]: https://github.com/Neo23x0/signature-base

Signed-off-by: Stefano Amorelli <[email protected]>