Clients can choose to turn off hCaptcha for certain forms

## Context
- Mechanism to choose whether they have hCaptcha protection
- Flexible version of captcha that comes after we move from "passive mode" to "blocking mode" #5749

## Description

**Option to opt-out of hCaptcha** _(Recommended by Policy)_

As we're introducing "blocking mode" for hCaptcha, we'll want a way to track whether legitimate submissions are sometimes being flagged as bots or marked as spam.

For certain use cases, it might become necessary to allow clients to opt out of the feature on a "per form" level, accepting the risks in order to not block any submissions. Some use cases will be more prone to suspicious-looking submissions that could fail, for example, users behind VPN, in incognito mode, with firewall rules, or other situations where the risk of blocking more vulnerable end users is greater than that of spam.

## Links

https://docs.google.com/document/d/15PzoOWs1EFme0Dl-NGSLMvnkaT3TsIBkKBTwQX0PM0U/edit?tab=t.0

https://docs.google.com/document/d/17pEcdr9dUWjtFvf3a8BtF78dQBiJkztsprzKePznjqs/edit?tab=t.0#heading=h.jglnn1y0awzx

https://docs.google.com/document/d/1QiWXA2y-gdzMtp4CRS3upv-XuSXZ7KLgKzKXyrbUrwg/edit?tab=t.0

Start by reviewing the issue description and its three linked policy and design documents, then trace how form-level configuration is represented in the NextJS application. Done means clients can opt out of hCaptcha for selected forms while the blocking-mode behavior remains available for others, with the relevant behavior covered by tests.

Written by the indexing model from the issue text.