feat(security): RN-1108: Prevent too many login attempts

[tcaiger]

Issue #: feat(security): RN-1108: Prevent too many login attempts

Changes:

• Install rate-limiter-flexible package
• Add login_attempts table to store rate limiting state based on node-rate-limiter docs
• Create a new TupaiaRateLimiter class that handles rate limiting logic
• Update authenticate endpoint handler to apply rate limiting

---

Screenshots:

[rohan-bes]

Looks really clean @tcaiger 🙏 Had a few comments, but also realised we totally forgot about the other auth methods, so might wanna chat about how we wanna handle them 👍

[rohan-bes]

Looks good! One comment about needing to check that it's password auth when checking if rate limited, but pre-approving 👍

[tcaiger]

@rohan-bes This is ready for another review. I started working on adding the RateLimiting to the server-boilerplate middleware but then I decided that it is quite a big increase in scope since this ticket is called login rate limiting. Since the middleware change would involve adding rate limit handling to all micro-service requests, I think it should be a new ticket and be refined if it's something that we intend to do.