CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scale