[FEATURE] interpolate variables in llm matcher/extractor prompts

[dogancanbakir]

Follow-up to #7733. Idea from @omarkurt (#7733 (comment)).

Interpolate {{...}} in an llm matcher/extractor prompt against the runtime values, the same DSL interpolation nuclei already uses elsewhere, so prompts can carry target, variable, and extracted context.

variables:
  system_role: "Senior Application Security Auditor"
  focus_area: "Authentication & Token Validation"

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    matchers:
      - type: llm
        part: body
        prompt: "Act as a {{system_role}}. Assess {{BaseURL}} for {{focus_area}} issues."
        expect: "yes"

The current per-target design makes this feasible: at match time the data map already holds {{BaseURL}}, variables, -var, and internally extracted values from prior requests.

Note on trust: variables, -var, and target values are operator-controlled and safe. Extractor-derived values come from the response and are attacker-influenced, so interpolating them into the instruction reintroduces prompt-injection risk. Decide whether to frame interpolated untrusted values (as FrameResponse does for the body) or restrict interpolation to trusted sources.