test: #3353376 Cover more CAPTCHA persistence cases

Jakob Prequested to merge
issue/captcha-3353376:3353376-create-further-persistence into 2.x

Closes #3353376

Test coverage only. Adds four methods to CaptchaPersistenceTest:

  • "Show always" validates every submission of a form instance, rotates the token, and rejects a replayed session ID and token on a fresh form.
  • "Per form instance": a CAPTCHA solved on a comment preview lets the same form instance be saved without a second challenge, and a new instance gets a new one.
  • A wrong response never omits later challenges, for any of the skip levels.
  • "Per form type" and "only once" are scoped to the visitor's session: another visitor still gets the challenge.

CaptchaWebTestBase::getCaptchaTokenFromForm() cast the base64 token to int (so every token read as 0); it now returns the string, which the replay test needs.

While writing these, they exposed Dynamic Page Cache serving one visitor's CAPTCHA-free form to others. That has since been fixed on 2.x by #3496865 (the session cache context on the element), so no runtime change is included here; the session-scope test now guards it. Full suite green on Drupal 10.6.6 and 11.

Merge request reports