New vulnerability detection module for CVE-2026-33017 (Langflow unauthenticated RCE)

CVE-2026-33017 (CVSS 9.8) is an unauthenticated flow-data injection vulnerability
in Langflow's /api/v1/build_public_tmp/{flow_id}/flow endpoint, added to CISA's
Known Exploited Vulnerabilities catalog. Prior to 1.9.0, the endpoint incorrectly
processed an attacker-controlled data parameter containing arbitrary
CustomComponent node definitions instead of using only the flow's stored data.

Reference: https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-33017

I'd like to add a new detection module for this (per @securestep9's guidance on
#1636 that new CISA KEV modules are high-value contributions). Will follow up
with a PR.