audit: remove hardcoded researcher OOB callback subdomains

[serialstream0]

A recent static-analysis audit of the public nuclei-template ecosystem identified templates in this repository that hard-code a third-party out-of-band (OOB) callback subdomain — researcher-controlled burpcollaborator.net, dnslog.cn, or ngrok.io endpoints — into the exploit payload, rather than using nuclei's {{interactsh-url}} per-scan placeholder.

Impact. Every time a user successfully exploits a vulnerable target with one of these templates, the target's outbound DNS/HTTP signal reaches the third party who controls the hard-coded subdomain — silently telling that party which target was scanned and when. It is not a scanner-host compromise, but it is an OPSEC leak that propagates indefinitely with every byte-identical copy.

This PR's changes:

Replace the hard-coded URL with {{interactsh-url}} (nuclei's per-scan, scanner-local OOB placeholder):

• apachesolrlfissrf.yaml — https://bugbounty.requestcatcher.com/ssrf → https://{{interactsh-url}}
• blind_ssrf.yaml — https://9a7d-183-82-25-4.ngrok.io → https://{{interactsh-url}}

Delete templates where in-place fix is not safe (URL embedded in a hex-encoded serialized payload, template's literal purpose is exfiltration, or xray YAML dialect that does not run under nuclei):

• CVE-2020-13942.yaml — xray YAML dialect (not nuclei) — uses {{
• ARPSyndicate/nuclei/cvescan/critical/CVE-2021-26295.yaml — OOB URL is embedded in a hex-encoded Java URLDNS payload inside ; cannot be safely substituted without runtime payload generation
• ARPSyndicate/jaeles/vulnscan/info/errors-n-vulns.yaml — xray YAML dialect (not nuclei)
• ssrf.yaml — xray YAML dialect (not nuclei)

These templates appear in this repository as byte-identical copies of upstream PoCs not authored here — the same patch is needed in many other community repositories.

A companion issue has been opened with the full file list and audit context.