Anti-bot changes

[InfinityLoop1]

This pull request implements some changes to reduce bot activity in public servers:

• Implements automatic kicking if the user gets a celerity of over 0.95 for 3 questions in a row
• Implements pseudo-controlled mode for permanent rooms, preventing skipping and rebuzzing and changing difficulties

Unrelated but bumps a NPM package version due to a security vulnerability This was fixed on main

[btfcookies]

what if the player is really good, because i know some people who can get a celerity that high 3 questions in a row and maybe more

[InfinityLoop1]

A celerity of over 0.95 is basically impossible to my knowledge; that's 95% of the question not revealed. While I am aware that people likely can get a buzz with very little information from memorizing, it's pretty unlikely that they're able to do it with such a high celerity and so consistently.
If this does prove to be a problem however, the celerity threshold or question count can be upped.

[InfinityLoop1]

@geoffrey-wu no rush but I was wondering whether you've had the chance to look at this

[geoffrey-wu]

Thanks for the PR! I'm happy to merge this but wanted to get your thoughts on two things first:

this.emitMessage({ type: 'bot-kicked', userId, username });

https://github.com/InfinityLoop1/website/blob/ca8edfbd18ef761eef8543f044353787318cc0b6/server/multiplayer/ServerTossupBonusRoom.js#L35

This doesn't do anything, since the bot-kicked message type is not implemented in MultiplayerTossupBonusClient.js. i'd either delete this or use the 'alert' type

I noticed a lot of diffs that added

-if (this.isPermanent || !this.allowed(userId)) { return; }
+if (this.isPermanent || this.settings.controlled || !this.allowed(userId)) { return; }

I think this is redundant, since !this.allowed should already handle controlled rooms, and i think these diffs should be undone