security: harden slider_captcha against brute-force, replay, and bot attacks

[Copilot]

The original implementation verified captcha answers entirely client-side with a predictable Random() PRNG, no attempt limits, no session binding, no movement analysis, and plain HTTP in the example service.

Changes

D — Cryptographically secure position generation

_RenderTestSliderCaptChar.create() now uses Random.secure() instead of Random(), making puzzle piece positions unpredictable.

C — Brute-force protection via maxAttempts

SliderCaptcha gains a maxAttempts parameter (default 5). On consecutive failures the widget auto-resets with a fresh random position and fires onConfirm(false) once.

SliderCaptcha(
  maxAttempts: 3,
  onConfirm: (passed) async { ... },
  ...
)

E — Drag-trail collection and bot heuristics

New SliderDragPoint / SliderMovementData classes (exported from the package) capture timestamped x-positions during every drag-update. Both SliderCaptcha and SliderCaptchaClient expose an onBehaviorData callback; callers forward the trail to their server for bot-detection.

SliderCaptcha(
  onBehaviorData: (data) {
    if (!data.isLikelyHuman()) rejectEarly();
    sendToServer(captchaId, data.trailToJson()); // server-side analysis
  },
  ...
)

isLikelyHuman() applies three client-side checks: minimum point count (≥5), minimum duration (≥300 ms), and non-zero velocity variance (threshold > 1e-10 to avoid float precision false negatives).

B — Session token (replay-attack prevention)

SliderCaptchaClientProvider accepts an optional captchaId field, populated from the server's requestID. Include it in the verification request body so the server can invalidate the token after a single use.

G — HTTPS enforcement in the example service

SliderCaptchaService now requires an explicit baseUrl (no default, to force conscious configuration) and asserts https:// at construction time:

// Throws ArgumentError immediately if baseUrl is plain HTTP
SliderCaptchaService(baseUrl: 'https://api.example.com');

The pre-existing broken Uri.https(fullUrl) call in postAnswer is also fixed.