hCAPTCHA allow list

hCAPTCHA was recently enabled on all GCForms and is clearly working (blocking bots and "suspicious" users). The downside to this is that some users flagged as "suspicious" may be legitimate users. A common example is a GC user that has additional security features (e.g. VPN) or running browser plugins to enhance security/*. We would like a way to allow known users to submit forms.

~~One idea is to investigate using the hCAPTCHA rules feature. Rules enable us to block or allow users based on criteria such as IP addresses. There may be other options as well. This issue is about exploring ways to allow known users to be flagged as "not suspicious" by hCaptcha.~~
The current hCAPTCHA setup would apply rules across all accounts. So that probably wouldn't be possible.
Another idea is to look into doing the above on the server side.

Note: an addition or workaround would be to allow disabling hCAPTCHA on a perform basis (see ticket [https://github.com/cds-snc/platform-forms-client/issues/5765](https://github.com/cds-snc/terraform-modules/blob/main/waf_ip_blocklist/lambda/blocklist.py#L207C1-L221C21))

Another idea (related PR) is to use an IP allow list and when a form submission is triggered, if a user is detected as having a GC IP, skip hCAHTPCA and let them submit the form. Here is a current solution is more of a proof of concept.
https://github.com/cds-snc/platform-forms-client/pull/6191

The code could be iterated on to use dynamic IP lookups which is more flexible and future proof. The work could be copied from:
https://github.com/cds-snc/terraform-modules/blob/main/waf_ip_blocklist/lambda/blocklist.py
As a note the `x-forwarded-for` or related to get the related form filler IP address would need to be added.

A potential issue would be identifying a potential spammer and then acting The problem is identifying a GoC user's computer by IP which is not trivial/possible because of how GoC networks are created. Also there are edge cases like SSC giving out IP addresses to universities. e.g. a library wifi could spam a form and we'd have no way to identify them. Without having an IP address to a computer we wouldn't be able respond to spam and could open a security risk for high volume spam.

Continuing this thought. The above would be solved not by hCAPTCHA but by our firewall, whether the user is an internal GoC user or external user. For example suppose a GoC user on a random network starts sending us 1k requests per minute, the firewall rule(s) would kick in and block them. So the above concern about how to identify and respond is solved by the firewall.

Note: A temporary solution could be to add more content about how to not be identified as suspicious by hCATPCHA. e.g. disabling a browser plugin.