Add pow support for web challenges

[sirdarckcat]

It's highly likely that someone running dirbuster on a .php file will cause issues, so we should add pow to web challenges too.

this can be done by wrapping the call to nsjail: https://github.com/google/kctf/blob/00ca1395f0e2492d6b7710c9db97bfb2ecf01bc5/samples/apache-php/challenge/files/cgi-bin/nsjail-php-cgi#L3

so that it checks:

1. If pow is enabled
2. if enabled, then check KCTF_POW cookie has a valid signed timestamp within tolerance
3. if cookie invalid, redirect to /.__kctf__/pow?continue=$path

and add /.__kctf__/pow that:

1. asks the user for a pow challenge
2. if the challenge is valid, set KCTF_POW cookie with a valid signed current timestamp
3. redirect user to ?continue param

[sirdarckcat]

cookies might be annoying, though.. perhaps we can drop this from Beta while we look at what people end up using in practice