Prevent user counter IDs from colliding with reserved range

In non-Commander games, newCounterId() could return 8 or 9, colliding
  with reserved commander tax counter IDs. A malicious client could
  exploit this via cmd_set_counter_active. Now user counters always
  start at ID 10+.

libcockatrice_network/libcockatrice/network/server/remote/game/server_player.cpp

@@ -74,7 +74,8 @@ int Server_Player::newCounterId() const
             id = c->getId();
         }
     }
-    return id + 1;
+    // Skip reserved IDs 0-9 even in non-Commander games to prevent collision
+    return std::max(id + 1, CounterIds::FirstUserId);
 }
 
 void Server_Player::setupZones()