Caching allows captcha validation bypass

Problem/Motivation

For some site configurations where forms are being cached, ALTCHA validation can potentially be bypassed.

Steps to reproduce

• Create any form with ALTCHA configured as CAPTCHA type
• Make sure the internal page cache module is enabled, and configured
• As an anonymous user, open the created form 2 times in the browser. It should have the same captcha_sid hidden field value when inspected via browser
• As an anonymous user, fill in the ALTCHA challenge and submit the first form
• As an anonymous user, skip the ALTCHA challenge (the required property should manually be removed via the browser inspector) and submit the second form

The second form submit should throw a validation error, but is actually submitted since the captcha_sid was already marked with status 1 in the captcha_sessions table.

Proposed resolution

Let the CAPTCHA module know the ALTCHA widget is cacheable, since we always use a custom validation callback, and don't store a solution in the captcha_sessions table anyway.