make it possible to have adminbot input pattern be dynamic

[0xLE]

What problem does this solve?

For instanced web challenges that require the use of admin bot, an author may want to only limit the input URL to the currently running instance.

Proposed solution

A potential solution would to have inputs be a callback like: inputs: (ctx) => ...

Workarounds or alternatives

This is currently doable, but it must be done imperatively in the handler.

[trixter-osec]

I mentioned this over Discord but I feel like it makes a lot more sense to keep the current design as the input regex can require a relative path (e.g. ^/.*), and then in the input handler you would always guarantee the URL be http(s)://hostname<user input>, which breaks any // tricks. This is generally also how every more-restricted admin bot is setup on challenges I've encountered (the user input is subpath, not the full URL)

As a nice side-effect, you can also then use new URL(...) helpers or whatever instead of relying on regex being the security boundary, as it gets pretty ugly fast (and fairly error-prone).