Added self-hosted GDPR compliant captcha module

[fballiano]

This PR adds a new Maho_Captcha module, which implements self-hosted GDPR compliant captcha based on https://altcha.org. Research was done but Altcha seems to be the most active other open source PoW based captcha project.

At the moment the implementation is almost the same as my Turnstile module: https://github.com/fballiano/openmage-cloudflare-turnstile with a lot of observers and a "css selectors" settings that (IMHO) allows for maximum flexibility.

I called it Maho_Captcha cause I think Maho should provide a basic captcha module and, since this one doesn't rely on 3rd party services (like cloudflare/recaptcha) it seems the perfect candidate.

Questions:

• I used maho_captcha.(xml|csv) naming instead of just captcha.(xml|csv) because I didn't want it to collide with the old Mage_Captcha. Is this a good choice?
• I used maho/captcha/footer.html as folder structure for templates. I don't like that it differs from maho_captcha but at the same time made more sense to have all modules under the maho/ folder. Is this a good choice?
• Should we apply this naming (or the final one that we decide) to New feature: blog #103 too? We should have a standard for every new development.
• Since the module positions the captcha widget "just before the ending" of the form, this position may not be perfectly aligned, is this a dealbreaker? ideas on how to make it better? activating the "floating" catpcha if works perfectly

[fballiano]

I don't like this line...

[fballiano]

Converted to draft because of altcha-org/altcha#92

[fballiano]

I found a way to work around the limitation of a single captcha per page so I think this PR is testable

[fballiano]

As per https://altcha.org/docs/server-integration/

Replay attacks

To prevent the vulnerability of “replay attacks,” where a client resubmits the same solution multiple times, the server should implement measures that invalidate previously solved challenges.

The server should maintain a registry of solved challenges and reject any submissions that attempt to reuse a challenge that has already been successfully solved.

we have to create a database table to store solved challanges and a cleanup routing after a few days (I'd use 7)

[fballiano]

I'd added the challenge-log in the captcha_challenge table, with a cron based cleanup routine

[justinbeaty]

we have to create a database table to store solved challanges and a cleanup routing after a few days (I'd use 7)

One thing I don't get is that the challenge expires in +30 seconds, so why do we have to keep track of them beyond that long? Is the documentation old or written before the expires field was supported?

[fballiano]

The thing that is worrying me is that the expire parameter doesn't seem to be baked into the challenge, i'm not sure about that

[justinbeaty]

The thing that is worrying me is that the expire parameter doesn't seem to be baked into the challenge, i'm not sure about that

It seems like it was, I watched the recaptcha widget re-spin on the frontend after around 30 seconds. It just seems to auto update if it knows it's expired.

Also, this commit seems to break the admin login for me. I haven't investigated why yet.
93b55ff using events to solve the single catcha per page limitation

[fballiano]

auch, i'll check out backend ASAP, thanks!