Arcade showcase security

[matytyma]

There seems to be almost no security when it comes to https://hackclub.com/arcade/showcase/* Backend sanitization and rate-limiting would be a great starting point.

• Injecting CSS was possible.
• There is inappropriate rate-limitting on project creation (I've managed to spam almost 600 projects in less than half an hour).
• I haven't checked, but there most likely isn't any length limit on other fields (except color since #1338)
• Hours spent can still be any string except for a number less than or equal to 0 and I don't want my showcase look like my Hyperskill profile does
• Images are not proxied and thus can be IP loggers (though one would need to proxy everything then and iirc HQ's location is known info)
• Code link is not required to be a valid URL

PS. I would make a PR but I'm a JS hater (neither am I sold to TS)

[kcoderhtml]

can you close this now?

[matytyma]

It's unrelated now, yeah