Bind low security password change to CAPTCHA completion

[r1kka6]

Summary

• record CAPTCHA completion in the server-side session before showing step 2
• consume the approved password values from session state and reject direct step-2 submissions

Verification

• docker run --rm -v "$PWD":/work -w /work php:8.3-cli php -l vulnerabilities/captcha/source/low.php
• vulnerable baseline returns Password Changed. for a direct step=2 POST
• patched runtime returns CAPTCHA validation is required. for the same direct step=2 POST