Add rack-attack throttler for all logins

We have a built-in bruteforce protection for built-in users. When users
are being created from LDAP on-the-fly, these limits cannot apply, as we
do not have a user object yet.

Instead, we can provide a more generous throttler to block attempts

config/initializers/rack-attack.rb

@@ -40,9 +40,15 @@ Rails.application.reloader.to_prepare do
       regex.any? { |i| i =~ req.path }
     end
 
-    Rack::Attack.blocklisted_responder = lambda do |_env|
-      # All blacklisted routes would return a 404.
-      [404, {}, ["Not found"]]
+    # Route blocklist returns 404.
+    # All other blocklists (for example, login ban)
+    # use the RateLimiting dispatcher set up by set_defaults!
+    Rack::Attack.blocklisted_responder = lambda do |request|
+      if request.env["rack.attack.matched"] == "block forbidden routes"
+        [404, {}, ["Not found"]]
+      else
+        OpenProject::RateLimiting.blocklisted_response(request)
+      end
     end
   end
 end