Add pow support for web challenges

It's highly likely that someone running dirbuster on a .php file will cause issues, so we should add pow to web challenges too.

this can be done by wrapping the call to nsjail:
https://github.com/google/kctf/blob/00ca1395f0e2492d6b7710c9db97bfb2ecf01bc5/samples/apache-php/challenge/files/cgi-bin/nsjail-php-cgi#L3

so that it checks:
1. If pow is enabled
1. if enabled, then check KCTF_POW cookie has a valid signed timestamp within tolerance
1. if cookie invalid, redirect to `/.__kctf__/pow?continue=$path`

and add `/.__kctf__/pow` that:
1. asks the user for a pow challenge
1. if the challenge is valid, set KCTF_POW cookie with a valid signed current timestamp
1. redirect user to `?continue` param