Improve bad submission handling

As of now, Shepherd removes points when users do bad submissions.

We've had issues where students use ZAP and inadvertently use an attack tool such as a directory traversal scanner. This sends several hundred requests to the result key submitter and then removes all their points.

The core issue is that the countermeasures are ineffective. Just removing points and writing a warning in the returned HTML output is not very good if the other end is ZAP and not a user using a browser.

I suggest that bad submissions first should result in the user being logged out. If attacks continue, the user should be banned for a minute, then 10 minutes, then an hour. This makes sure that unwitting users (who often are complete beginners to infosec and attack tools) don't do things they don't want.

No files, tests, or entry points are named. Start by locating the bad-submission countermeasures and the returned HTML warning, then trace how submissions identify and affect users. Done means bad submissions trigger logout first, followed by escalating one-minute, ten-minute, and one-hour bans for continued attacks.