Third plugin: jslibscan, a Retire.js-style passive JS library scanner

The first purely passive plugin in the reference set: subscribe,
inspect a response body already captured by ordinary proxying, tag -
no repeat calls at all, unlike authcheck and paramminer. Deliberately
included as the safest possible plugin to try first, since it never
sends anything of its own.

Checks any JS library version string found in a response against a
small, explicitly-illustrative built-in table (jQuery, Lodash,
Handlebars, Moment.js, AngularJS - one well-known vulnerable-version
threshold each), tagging a match jslibscan:hit with the version found,
the fix version, and a plain-language advisory. Not a maintained
vulnerability feed the way real Retire.js's database is, and says so
in its own package doc; CVE numbers deliberately omitted in favor of
describing the vulnerability class, rather than asserting a specific
identifier this reference implementation hasn't independently verified.

Found and fixed a real regex bug by testing live rather than trusting
the code: the first version failed to match jQuery's own actual banner
comment ("jQuery v1.8.3") because the separator pattern only allowed a
single character between library name and version digits, and that
banner has two (space, then "v"). Fixed with a bounded non-greedy gap
verified against three real-world version-string shapes at once
(banner comment, minified filename, cache-busting query string) before
going back into the plugin.

Verified live end to end: a real daemon, a real origin serving both an
outdated jQuery 1.8.3 banner and a current 3.7.1 one - the outdated
file was correctly tagged with the right version and threshold, the
current one correctly left alone. The same run incidentally
reconfirmed the regex fix was real: an entry captured moments earlier
against the buggy binary sat right next to the correctly-tagged one,
itself untagged.

1 files changed, 4 insertions, 3 deletions

diff --git a/README.md b/README.md
index b23ba4e..4c73472 100644
--- a/README.md
+++ b/README.md
@@ -70,9 +70,10 @@ the same socket the TUI itself uses - see [`PLUGINS.md`](PLUGINS.md).
   a badge in the history list, searchable via `tag:name`, viewable
   (`T` from detail view) with JSON data syntax-highlighted the same way
   a pretty-printed response is. See [`PLUGINS.md`](PLUGINS.md) and
-  `plugins/authcheck`/`plugins/paramminer` for real, working ones (an
-  Autorize-style authorization checker, a Param Miner-style hidden
-  parameter prober).
+  `plugins/authcheck`/`plugins/paramminer`/`plugins/jslibscan` for
+  real, working ones (an Autorize-style authorization checker, a Param
+  Miner-style hidden parameter prober, a Retire.js-style scanner for
+  known-vulnerable JS library versions).
 - **Comparer**: mark one entry (`c`), then `c` on a different entry to
   see a colored unified diff of either side's request or response.
 - **Decoder**: standalone URL/Base64/Hex/HTML encode and decode (`d`),