cmd/anubis: Use many easy challenges instead of one hard challenge?

[Xe]

Kinda like how Tor hidden service DDOS mitigation works.

Blocked on #645

[DarkSpir]

One thing I noticed this morning is that the difficulty 5 check takes about 3 seconds on an Intel Core i5-10310U laptop running Firefox on Windows 11 and 14.5 seconds on a Ryzen 7 7840HS laptop running Firefox on OpenSUSE Linux. The Ryzen 7 is in single core at least 1.5 times faster than the i5 and in multi core it's more 4.5 times faster according to benchmarks I took. I'm pretty sure this is not an Anubis issue but something on my Linux laptop I have to figure out...

(Edit: And I was right, it was an configuration issue with my Laptop.)

But that brings me to the point: There are systems out there (Smartphones, RasPis, Laptops, PCs) that are faster and chew through the difficulty like cake and there are systems that are slower (old hardware or misconfiguration as in my case) and struggle with higher difficulty settings. So the definition between "easy" and "hard" challenge diverses a bit at this point.

One approach could be to run a short benchmark for like 0.5s in the begining to get a vague baseline of the systems capabilities. But that would also mean that the javascript code needs to change the difficulty on the fly (or you need to make one extra request to the server where you send the benchmark result and receive a challenge customized to this benchmark). That means the client can (and probably will) manipulate the challenge difficulty. I'm not sure if there is even a good middle way for that...