fix: #3439550 Keep the CAPTCHA on forms rebuilt by limited validation buttons

A triggering element with #limit_validation_errors made the CAPTCHA element return before building anything. The triggering element stays set while the form is rebuilt, so a form re-rendered after such a button (Commerce Shipping's recalculation, any AJAX refresh of the whole form) lost its challenge.

Build the challenge in the posted CAPTCHA session instead, and only skip it when there is no session to reuse. No session is created and no validation handler is attached, so the token stays valid and the partial submission is not counted as an attempt. The solution is stored on render, so an AJAX response that leaves the CAPTCHA out keeps the old one valid.

This replaces the Commerce-specific #recalculate check, which ran full CAPTCHA validation on the recalculation request.

Closes #3439550