Add manual SQL Injection steps into A1 app

## Motivation

[Copy-and-Paste](https://github.com/globocom/secDevLabs/tree/master/owasp-top10-2017-apps/a1/copy-n-paste)'s attack narrative makes use only of SQLMap to show how an automated SQL injection could be performed.

## It would be great if

We could also have the queries needed to perform an exploration of the intentionally vulnerable app manually. This would be interesting due to the fact that SQLMap can be very intrusive and dangerous to the application functionality.

## What we expect

We expect to have the manual steps written down in the [README.md](https://github.com/globocom/secDevLabs/blob/master/owasp-top10-2017-apps/a1/copy-n-paste/README.md) with an explanation on how and why these commands work.

`curl -s -H "Content-Type: application/json" -d '{"user":"-1'\'' ", "pass":"password"}' http://127.0.0.1:10001/login`

## Tips

* [Testing for SQL Injection - OWASP](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection)
* [Full SQL Injection Tutorial - Exploit DB](https://www.exploit-db.com/papers/13045)
* [SQL Injection Ninja Testing Labs - LeetTime ](http://leettime.net/sqlninja.com/)