Cap.js widget assets

SHIELD-X vendors the Cap.js widget browser asset and WASM solver so the optional
Human Challenge feature can run without loading JavaScript from a CDN.

- Project: Cap.js
- Components:
  - `cap-widget` 0.1.56 (`cap.min.js`)
  - `@cap.js/wasm` 0.0.7 (`cap_wasm_bg.wasm`)
- Source: https://github.com/tiagozip/cap
- License: Apache-2.0
- Upstream GitHub license instruction: "This project is licensed under the
  Apache-2.0 License, please see the LICENSE file for details."
- Copyright: Copyright 2025 Tiago; upstream README says Copyright 2025 -
  present tiago.
- Upstream package metadata:
  - `cap-widget` author: Tiago; repository: git+https://github.com/tiagozip/cap.git
  - `@cap.js/wasm` author: Tiago; repository: git+https://github.com/tiagozip/cap.git

License files included with SHIELD-X:

- `LICENSE-CAP-WIDGET.txt` preserves the upstream package copyright and
  Apache-2.0 notice shipped with `cap-widget` 0.1.56.
- `LICENSE-APACHE-2.0.txt` is copied from the upstream GitHub `LICENSE` file
  and applies to both vendored Cap components.
- `cap-widget-src/` contains readable upstream `cap-widget` 0.1.56 source files
  copied from the npm package for reviewer auditability.

No separate upstream NOTICE file was present in the vendored npm packages; this
file is SHIELD-X's third-party notice for the bundled Cap assets.

WordPress.org compatibility patch:

- Removed the upstream jsDelivr pako fallback. Browsers without
  `DecompressionStream` can still use an already-present local `window.pako`,
  but SHIELD-X will not load executable code from a CDN.
- Removed the upstream jsDelivr WASM fallback. SHIELD-X sets
  `CAP_CUSTOM_WASM_URL` to the bundled local `cap_wasm_bg.wasm` file.
- Preserved upstream copyright, source, and Apache-2.0 attribution in this
  NOTICE, the full Apache-2.0 license file, and the bundled JavaScript header.

The widget remains optional and disabled unless an administrator enables the
Human Challenge controls.
