Implement bot protection in auth flow handlers

[pkong-ds]

Blocked by

• 4382

Notes

This PR only address 3 out of 4 items of DEV-1413

• [x] ~Output captcha information when captcha is enabled in the flow response.~ Outdated, ref https://github.com/authgear/authgear-server/pull/4282#discussion_r1646846518
• [x] Output captcha requirement in branches.
• [x] Store captcha verification status in authenticationflow.Session
• [ ] Enforce captcha in branches. That is, when accepting input in a branch that requires captcha, it should check is the authflow session has captcha verification passed. If not, return the error as specified in the spec.`

Why? - to prevent conflict of 4th point with another PR #4372

[pkong-ds]

@louischan-oursky Can I have you attention to my current way of injecting config.AuthenticationFlow inside Service But I feel like there is a better way, any thoughts? :Adore:

• 1984432 - Inject AuthFlowConfig into auth flow service
• 425c3ea - Check per-flow captcha enabled flag in flow response

[pkong-ds]

@louischan-oursky free to go through the 2 FIXME commits with me later? 🙏 Not sure which branch should these intent point to for captcha requirement checking

• ba263f4 - FIXME: Default no captcha for uncertain identify steps
• 392a759 - FIXME: Default no captcha for reauth authenticate

[pkong-ds]

@louischan-oursky this should be ready for review :adore:

Note: Quick search seem no test on the 3 api handlers; so did not add tests for extra bot_protection fields. Please advise if otherwise 👍

[pkong-ds]

@louischan-oursky updated, thanks! Added 2 commits, starting from f53fa58