move xss-bot from npm's proof-of-work to kctf's

[sirdarckcat]

it's a bit confusing we have two
https://www.npmjs.com/package/proof-of-work

[sirdarckcat]

this is trivial, it just means making xss-bot a stdio task, rather than a socket one.