hCaptcha Support

[jolheiser]

This PR aims to add support for hCaptcha

Related to #12582, but may not completely close it.

Since the captcha errors aren't necessarily meaningful to translate to end-users, for now they are just being debug-logged (previously they weren't handled at all, so this is an improvement???)

[techknowlogick]

Option 2 makes sense, perhaps we could also use the lessons learned from your library and apply them to the recaptcha one.

[codecov-commenter]

Codecov Report

Merging #12594 into master will decrease coverage by 0.01%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##           master   #12594      +/-   ##
==========================================
- Coverage   42.59%   42.57%   -0.02%     
==========================================
  Files         671      672       +1     
  Lines       73625    73676      +51     
==========================================
+ Hits        31363    31370       +7     
- Misses      37180    37228      +48     
+ Partials     5082     5078       -4     

Impacted Files	Coverage Δ
modules/auth/user_form.go	39.65% <ø> (ø)
modules/auth/user_form_auth_openid.go	0.00% <ø> (ø)
modules/hcaptcha/hcaptcha.go	0.00% <0.00%> (ø)
modules/recaptcha/recaptcha.go	0.00% <0.00%> (ø)
modules/setting/setting.go	47.61% <ø> (ø)
routers/user/auth.go	11.47% <0.00%> (-0.12%)	⬇️
routers/user/auth_openid.go	0.00% <0.00%> (ø)
modules/charset/charset.go	68.53% <0.00%> (-4.50%)	⬇️
services/pull/check.go	47.69% <0.00%> (-0.77%)	⬇️
... and 5 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7670a9d...1fb2a2e. Read the comment docs.

[zeripath]

We need some way of cancelling these calls. They're potentially preventing Gitea shutdown and I wonder if they could be used in a port exhaustion attack.

[jolheiser]

@zeripath Done. 🙂

[zeripath]

Golangci-lint demands a sacrifice... Done

[zeripath]

I'd argue this could go into 1.13 as it's ready to be merged

[techknowlogick]

Thanks :)

[jolheiser]

A few things to note with the latest changes...

1. challenge_ts was sometimes returning a timestamp that Go choked on parsing, so both hcaptcha and recaptcha now just marshal it to a string. We weren't using the timestamp, but if it was needed in the future we can look at parsing it then.
2. There was a potential slice index issue that has been fixed because a successful check meant the ErrorCodes slice was empty.