refactor: move go-chi/captcha into Gitea (#39529)

The `gitea.com/go-chi/captcha` package only exists for Gitea,
so it moves into `modules/imagecaptcha`.

- Reloading an expired challenge shows a new image instead of a broken one
- Every answer is consumed on its first check
- OpenID registration stops after a failed captcha

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

routers/web/auth/auth_test.go

@@ -17,8 +17,10 @@ import (
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/test"
 	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
 	"gitea.dev/services/auth/source/oauth2"
 	"gitea.dev/services/contexttest"
+	"gitea.dev/services/forms"
 
 	"github.com/markbates/goth"
 	"github.com/markbates/goth/gothic"
@@ -199,3 +201,18 @@ func TestOpenIDRequireTwoFactor(t *testing.T) {
 	openIDRequireTwoFactor(ctx, user2, false, "https://example.com/id")
 	assert.False(t, ctx.Written())
 }
+
+func TestRegisterOpenIDPostRejectsWrongCaptcha(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	defer test.MockVariableValue(&setting.Service.EnableCaptcha, true)()
+	defer test.MockVariableValue(&setting.Service.CaptchaType, setting.ImageCaptcha)()
+	sess := session.NewMockMemStore("dummy-sid-openid-register")
+	require.NoError(t, sess.Set("openid_verified_uri", "https://example.com/openid"))
+
+	ctx, _ := contexttest.MockContext(t, "POST /user/openid/register", contexttest.MockContextOption{SessionStore: sess})
+	contexttest.MockRequestPostForm(ctx.Req, url.Values{"captcha_id": {"unknown"}, "captcha": {"000000"}})
+	web.SetForm(ctx, &forms.SignUpOpenIDForm{UserName: "openid-captcha-user", Email: "openid-captcha-user@example.com"})
+	RegisterOpenIDPost(ctx)
+	assert.Equal(t, true, ctx.Data["Err_Captcha"])
+	unittest.AssertNotExistsBean(t, &user_model.User{LowerName: "openid-captcha-user"})
+}