[Dev3 ^~^ (shashank03-dev)]

Related to #3324

The SQL injection and XSS scorers missed some very common payloads, so a response with a working exploit in it was scored as safe.

• SQLInjectionOutputScorer missed ' OR '1'='1, admin' OR 1=1-- and UNION/**/SELECT. It now flags a quote followed by OR and a value compared to itself, and allows comments between UNION and SELECT. Like the existing comment check, it skips escaped quotes and normal quoted strings, so name = 'bob' OR 1=1 and Pick 'a' OR 'b'. still score False.
• XSSOutputScorer missed javascript: links written with HTML character codes or with tabs and newlines inside the word, like jav	ascript: or javascript:. Browsers decode these and still run the script. The href/src/action/formaction check now accepts these forms, and still ignores look-alikes that decode to a different character, like &#x6Aavascript:.

Not covered here: OR TRUE, 'a'<>'b', ||, MySQL /*!...*/ comments, and encoded javascript: outside an HTML attribute. Custom patterns behave the same as before.

Tests: Added matching and non-matching cases for each new form. The XSS cases agree with Python's HTML parser, including 100,000 random variations that cover both letter cases and every encoding form, and the SQL cases were run against a vulnerable SQLite query to confirm they work as exploits. Two existing ' OR '1'='1'-- tests now also report Tautology Bypass.