Replace low XOR scheme with authenticated encryption

[r1kka6]

Summary

• replace the repeating-XOR + Base64 construction with AES-256-GCM using random session-held keys
• separate the public message-exchange key from the intercepted-secret key so the decode form cannot decrypt the challenge secret
• remove the hard-coded password path by reading an optional DVWA_CRYPTOGRAPHY_LOW_PASSWORD value or generating a per-session fallback secret, and compare it with hash_equals()

Verification

• php -l passed for vulnerabilities/cryptography/source/low.php
• vulnerable baseline lets the public decode form turn Lg4WGlQZChhSFBYSEB8bBQtPGxdNQSwEHREOAQY= into Your new password is: Olifant and then accepts password=Olifant
• patched runtime produces different ciphertexts for the same plaintext, round-trips a session-owned message, rejects both the displayed intercepted ciphertext and the old XOR ciphertext with Invalid message, and still accepts the configured positive-path password when DVWA_CRYPTOGRAPHY_LOW_PASSWORD=Olifant is set