fix(lanzou): handle acw_sc__v2 anti-crawler challenge on all requests (#9548)

The acw_sc__v2 challenge can be served on any pan.lanzoui.com request (share page, iframe page, ajaxm.php), but it was only handled for the first share page. This caused intermittent failures:

• “uid variable not find” when mydisk.php returned the challenge on init
• “not find data” when the iframe download page returned the challenge
• empty “failed get link” when ajaxm.php POST returned the challenge (the challenge HTML was parsed as JSON, zt=0 -> empty info)

Also fix HexXor, which was broken since the driver was introduced and made every challenge unsolvable:

• bytes.NewBuffer(make([]byte, len(hex1))) prefixed the result with len(hex1) null bytes
• missing zero-padding produced a single hex char when xor result < 0x10, misaligning the whole string

Move the challenge solve/retry loop down into request() so every GET/POST transparently handles it, and simplify getHtml accordingly.