feat: add challenge 76 with simulated RAG vector store secret leak

[bhushan4work]

What kind of changes does this PR include?

• Fixes or refactors
• A new challenge
• Additional documentation
• Something else

Description

Adds challenge 76, an AI security challenge demonstrating how an unauthenticated RAG vector store can expose sensitive indexed data.

• Implements a simulated vector store containing a development secret.
• Adds an unauthenticated GET /rag/search endpoint that allows players to retrieve indexed chunks.
• Validates submitted answers against the exposed secret.
• Adds unit tests covering answer validation, endpoint access, query filtering, and challenge registration.
• Adds challenge explanations, hints, and reasons in the supported languages, along with localization coverage.

Relations

Closes #2653

References

None.

Checklist:

• All the contributions made are solely the work of me and my co-authors
• I used AI to generate parts of the content.
• I tested the changes in this PR (if applicable)
• I added unit tests to ensure my change works (when change in Java or on front-end code)
• I added UI tests to ensure my UI changes work (when change in the overall UI, not needed if just adding a challenge)
• The PR passes pre-commit hooks and automated tests

[github-actions]

🧪 Testing this PR locally

If you already have the repository

First, make sure the official OWASP WrongSecrets repository is configured
as the wrongsecrets-upstream remote:

git remote get-url wrongsecrets-upstream >/dev/null 2>&1 || \
  git remote add wrongsecrets-upstream https://github.com/OWASP/wrongsecrets.git

Then fetch and check out this PR:

git fetch wrongsecrets-upstream pull/2736/head:pr-2736
git checkout pr-2736

If you already have a wrongsecrets-upstream remote, the first command
leaves it unchanged.

Or, if you want the contributor branch directly

If the contributor repository is already configured as origin:

git fetch origin
git checkout -b test-pr-2736 origin/fix#2653

🧹 Cleaning up after testing

When you are finished testing, you can remove the local PR branch:

git checkout main
git branch -D pr-2736

If you added the wrongsecrets-upstream remote specifically for testing
this PR and no longer need it, remove it with:

git remote remove wrongsecrets-upstream

⚠️ Only remove wrongsecrets-upstream if you added it for this test.
If you already had this remote before testing, keep it.

PR: #2736
Branch: fix#2653
Repository: bhushan4work/wrongsecrets

[commjoen]

Thank you @bhushan4work for your PR! Can you take a look at the first comment for now?

[commjoen]

can you for now create some vector store that is external to the system?
this can be an AI-native store, a traditional hybrid setup, or some in memory library : e.g. a real existing one

[bhushan4work]

on it, will update it