Require observed flag checks for auto-validated crackmes

[xusheng6]

Summary

• Require uploaders to enter the flag they observed from the submitted file and verify it matches the auto-validation flag in CMO format.
• Require reviewers to independently enter the observed flag before approval, and require the same check when an admin changes a flag or replaces a flagged file.
• Preserve the entered value after a rejected upload and document the upload requirement.

Verification

• .venv/bin/python -m pytest -q tests/test_solves.py tests/test_reviewer_operations.py (78 passed)
• git diff --check

The check relies on the uploader and reviewer actually running or inspecting the challenge. It does not execute arbitrary uploaded files on the server.

[xusheng6]

Close as not needed -- the website already checks the flag for initial upload, review, and crackme edits. The flag cannot be possibly set to a wrong format.

What happened was that a user accidentally made a crackme that accepts a flag in the style Flag{xxxx}, which is in the wrong format. He still set sth to the right format on the website, i.e., CMO{xxxx} (which I do not know the exact value), but that does not work. It should have been rejected during review