CAPTCHA support

[hughns]

During registration, and optionally other operations. To replace the HS capability such as https://github.com/matrix-org/synapse/blob/develop/docs/CAPTCHA_SETUP.md

Open questions:

• Which CAPTCHA provider should we support? With CAPTCHA verification during registration #2759, we will support all of:
  • reCAPTCHA is what we already support in Synapse
  • hCaptcha for a non-Google alternative, highly requested in Synapse by the community
  • Cloudflare Turnstile might be the most user-friendly?
• What operations should be protected? Obvious candidates are:
  • Password-based login
  • Password-based registration
  • Password change
  • When adding an email address
• Where does it fit in the login/registration forms? -> Design suggestion in CAPTCHA verification during registration #2759
• What configuration knob do we give to administrators?

Relevant spec issue: matrix-org/matrix-spec#295

[richvdh]

Worth noting that there is a lot of desire from the free software community to support captcha implementations other than reCaptcha (see matrix-org/matrix-spec#295).