feat: switch from reCAPTCHA to the CF turnstile

[wescopeland]

Google is billing us for reCAPTCHA. There are alternatives; reCAPTCHA isn't worth spending donor money on.

We still need deeper protection on this specific page than Cloudflare WAF. WAF doesn't guard against things like headless browsers using residential IP addresses.

This PR migrates account registration's anti-bot protection measure from reCAPTCHA to the Cloudflare Turnstile, operating in managed mode.

Prod env vars are already set via Forge. For security reasons, they do not work locally. If no env vars are set, the turnstile control does not appear. For testing locally, you can use the following in your .env:

# force success
CLOUDFLARE_TURNSTILE_SITE_KEY="1x00000000000000000000AA"
CLOUDFLARE_TURNSTILE_SECRET_KEY="1x0000000000000000000000000000000AA"

# force failure
CLOUDFLARE_TURNSTILE_SITE_KEY=2x00000000000000000000AB
CLOUDFLARE_TURNSTILE_SECRET_KEY=2x0000000000000000000000000000000AA

[greptile-apps]

Greptile Summary

Migrates registration anti-bot protection from reCAPTCHA to Cloudflare Turnstile.

• Adds server-side Turnstile verification.
• Updates registration UI, CSP, configuration, translations, and tests.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

_{Reviews (2): Last reviewed commit: "chore: add missing file" | Re-trigger Greptile}

[Jamiras]

Minor: When the turnstile verification fails, the fields get cleared out. On a short password failure, the fields remain filled in.

[Jamiras]

Is there any reason not to leave the success and failure keys in here and just comment them out?

I don't expect to be testing this functionality again once the PR is merged, but if I had to, I don't know if I'd be able to find the keys.

[Jamiras]

Unrelated (also happens on master): On success, the page reloads, which triggers another human-validation. Consider redirecting to the main page, or the login page.