Add bruteforce protection in OauthApiController

[julien-nc]

Client secrets are long so bruteforce attacks are not likely to be effective but still.

[AndyScherzinger]

/backport to stable27

[AndyScherzinger]

/backport to stable26

[AndyScherzinger]

/backport to stable25

[AndyScherzinger]

/backport to stable24

[miaulalala]

/rebase

[backportbot-nextcloud]

The backport to stable26 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable26
git pull origin stable26

# Create the new backport branch
git checkout -b fix/foo-stable26

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts. Resolve them.
git cherry-pick abc123

# Push the cherry pick commit to the remote repository and open a pull request
git push origin fix/foo-stable26

More info at https://docs.nextcloud.com/server/latest/developer_manual/getting_started/development_process.html#manual-backport

[backportbot-nextcloud]

The backport to stable24 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable24
git pull origin stable24

# Create the new backport branch
git checkout -b fix/foo-stable24

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts. Resolve them.
git cherry-pick abc123

# Push the cherry pick commit to the remote repository and open a pull request
git push origin fix/foo-stable24

More info at https://docs.nextcloud.com/server/latest/developer_manual/getting_started/development_process.html#manual-backport

[julien-nc]

Backport for stable26 will be easier after #38708 is merged.

@AndyScherzinger Do we really have to backport to stable24?

[nickvergessen]

Do we really have to backport to stable24?

yes

[AndyScherzinger]

Do we really have to backport to stable24?

As stated by Joas: yes, we do have support cohorts defined based on the severity of a sec issue the number of years we need to backport the fix is defined - which is why I initially added all the backport commands right away

[nickvergessen]

/backport to stable26