Make renderhitbox a netvar to prevent clientside wallhacking

Assuming this works the same way as registering a var from lua this will restrict toggling of renderhitbox to the host and sync it for everyone