Add Lua level: Metatable Hooks (revives #128 by @TheDarkThief)

[ZayanKhan-12]

This revives the Lua metatable __index hook level from #128 by @TheDarkThief, which @jkcso reviewed and wanted to accept but which has since gone stale and now conflicts with the current Season 4.

All credit for the level goes to @TheDarkThief — the commit is authored under their name and the content is unchanged apart from the re-homing described below.

What changed vs #128

• Re-homed to Bonus-Levels/Lua-Metatable-Hooks/ instead of Season-4/Level-1/. When Adding New Level: Lua Metatable hooks #128 was opened, Season 4 did not exist; main now has the full ProdBot Season 4, so the original path collides (add/add on Season-4/README.md, .devcontainer/devcontainer.json). A standalone folder keeps the ProdBot narrative intact and resolves all conflicts.
• Dropped #128s .devcontainer / codeql-analysis.yml edits, which had become stale rollbacks (they removed the current ProdBot setup and downgraded actions/checkout@v7→v4, codeql-action@v4.37.3→v3). Instead this only appends lua5.4 + luarocks + busted and the sumneko.lua extension to the existing devcontainer.
• Updated in-file path references and added a self-contained README.md.

The level

A Lua metatable __index hook that exfiltrates a local (secret_key) via debug.getlocal when the vulnerable code indexes a table with nil gaps. The fix sanitizes untrusted tables with a pcall(setmetatable, t, {}) guard (a set __metatable throws, revealing the hook).

Tests (busted)

• tests.lua → 2/2 pass
• solution/solution_test.lua → 3/3 pass
• hack.lua fails against the vulnerable code.lua by design (that failing exploit test is the challenge)

On process & placement

I know CONTRIBUTING.md asks for a Discussions proposal first — I opened this as a PR because the level was already maintainer-reviewed in #128. Happy to move it to a New Level Proposal discussion, and happy to relocate it (e.g. a numbered Season slot) if you prefer a different home. Also glad to close this in favour of @TheDarkThief updating #128 directly if that is the maintainers' preference.

[ZayanKhan-12]

Closing in favor of the original PR #128 by @TheDarkThief — I've offered the re-homed, conflict-free version there for them to fold into their own PR so credit stays with the original author. No need for a competing PR. Thanks!