Security hardening: XSS prevention, input validation, rate limiting

Add agent URL hyperlinks, replay downloads, and submit_with_replay endpoint

Add upload form, API endpoint, 5 difficulty tiers, real game data

Fix scoring dedup, add test suite, wire openra-rl-util

Revert "Fix scoring dedup, add test suite, wire openra-rl-util"

Fix scoring dedup, add test suite, wire openra-rl-util