Add Msf::Exploit::Remote::HTTP::Windmill mixin

[Chocapikk]

Hello Metasploit Team,

This adds Msf::Exploit::Remote::HTTP::Windmill, an HTTP mixin for interacting with the Windmill workflow automation platform.

This is PR 2/5 of the Windfall suite. Depends on #21242 (Rex::Proto::PostgreSQL). Required by #21245 (Windmill Modules).

What It Does

The mixin provides exploit primitives for Windmill and Nextcloud Flow deployments:

• Detection: Auto-detects deployment type (standalone, Flow proxy, Flow direct) via response fingerprinting
• Path traversal: File read via CVE-2026-29059, auto-applies triple URL encoding for proxy deployments
• Authentication: JWT forging using leaked jwt_secret, token verification, login
• Workspace management: Auto-discovery, creation if needed
• Job execution: Run bash/python/deno via Windmill's job API, poll for results
• PostgreSQL extraction: Uses Rex::Proto::PostgreSQL to extract credentials from heap files without DB access

Files

File	Purpose
lib/msf/core/exploit/remote/http/windmill.rb	Main mixin loader
lib/msf/core/exploit/remote/http/windmill/constants.rb	API endpoints, paths
lib/msf/core/exploit/remote/http/windmill/http_helpers.rb	Request helpers, encoding
lib/msf/core/exploit/remote/http/windmill/detection.rb	Deployment detection
lib/msf/core/exploit/remote/http/windmill/auth.rb	JWT forging, authentication
lib/msf/core/exploit/remote/http/windmill/workspace.rb	Workspace management
lib/msf/core/exploit/remote/http/windmill/file_read.rb	Path traversal file read
lib/msf/core/exploit/remote/http/windmill/jobs.rb	Code execution API
lib/msf/core/exploit/remote/http/windmill/postgres.rb	PostgreSQL heap extraction

Verification

msfconsole -q -x "require 'msf/core/exploit/remote/http/windmill'; puts 'Windmill mixin loaded'; exit"