Optimize user logins by avoiding duplicate entity queries

Another one:

UserLoginForm::validateName() does exactly the same checks as UserLoginForm::validateAuthentication() except that the latter doesn't set the same error message if it can't find an account. If we move the validation message around, we save yet another identical entity query.

Pushed an additional commit to deprecate ::validateName() instead of removing it, and removed the call to user_is_blocked() by just checking status on the entity, this removes an extra query on a failed login too.

Also opened #3410707: Optimize UserAuthenticationController by remove duplicate entity queries as a follow-up, doing it here would double the MR size since UserLoginController more or less copies the form logic 1-1, so we need to make all the same changes there more or less.

Back to needs review for those changes.

We need a change record for the UserAuthInterface method addition too, should probably be a separate change record to the form validation deprecation.

The existing method on the interface definitely shouldn't have type hints added in this issue, that's out of scope (and would have to be implemented completely differently to how it is in the MR due to bc).

Reverted the out of scope changes to the methods we're not adding here, tightened up type hinting on the new method, also made the new method return bool instead of bool/int since we already have the uid available before we call it.

Rebased. Just a couple of merge conflicts in the assertions. #3396196: Separate cache operations from database queries in OpenTelemetry and assertions will allow all the assertions in these tests to use assertSame() which will make it much easier to see the impact of changes like this.

Rebased again after #3396196: Separate cache operations from database queries in OpenTelemetry and assertions which now makes it much easier to see what the effect on the database query count is.

Rebased, accepted the suggestions, and updated the comment. Since all those changes were minor, moving back to RTBC.

Also removing the 'needs change record' tag since that's done now.

Rebased after #3421164: Log every individual query in performance tests

Updated both CRs.

I had a quick look at putting the blocked logic on UserAuth::authenticate() but that runs into problems with the $uid/FALSE return value.

There are three reasons the method could return FALSE:
1. The username doesn't exist
2. The password is wrong
3. The user is blocked.

Then on top of that, we've got the extra flood control checking which can prevent login even if none of the above are true, although all that logic is in the form still.

For the login form, we currently tell people if the user is blocked - so to get this information we need to have a loaded user, but we can't get that information from a uid/FALSE return value. If we wanted to load the user outside this method and check if they're blocked, we'd need the uid, but you only get that if the auth was successful, so it would have to run the entity query again.

This makes me think we maybe need a new interface, it could be called UserAuthenticationInterface, and it probably needs to return a value object like UserAuthenticationResult - with ::getAccount() ::isBlocked() methods at least.

This doesn't cleanly revert so I've made a revert MR. Moving direct to RTBC because it's only a couple of small merge conflicts in StandardPerformanceTest so should be good as long as gitlab comes back green.

#2431357: Extract a reusable UserAuthFlood service and reuse it in UserLoginForm and BasicAuth and UserAuthenticationController is doing pretty much what I think we need for #3410582-43: Optimize user logins by avoiding duplicate entity queries so I may just try to revive that issue.

Committed/pushed the revert MR. Back to needs work, but we might end up in #2431357: Extract a reusable UserAuthFlood service and reuse it in UserLoginForm and BasicAuth and UserAuthenticationController instead.

I started to look at re-rolling #2431357: Extract a reusable UserAuthFlood service and reuse it in UserLoginForm and BasicAuth and UserAuthenticationController but found a couple of issues - it's very far behind and much, much bigger scope than this issue, but more importantly, it would make the mail_login bc break potentially worse by ignoring the old service and using a brand new one, meaning logging in with e-mail would silently fail to work.

However thinking about the various ways the bc break could be ameliorated resulted in an idea - new interface UserAuthenticationInterface with two new methods: ::lookupAccount() and ::authenticateAccount(). mail_login then would only need to override ::lookupAccount() and ::authenticateAccount() could fall through to the interface.

Pushed up changes to the original MR - reverting the revert, then refactoring a bit to make the deprecation more graceful per the above.

This should make things slightly easier, or at least no-worse, for #2431357: Extract a reusable UserAuthFlood service and reuse it in UserLoginForm and BasicAuth and UserAuthenticationController too.

Because we're deprecating the old interface we now need to incorporate #3410707: Optimize UserAuthenticationController by remove duplicate entity queries and #3410707: Optimize UserAuthenticationController by remove duplicate entity queries here to avoid triggering deprecation errors from those classes.

Rebased.

Updated the CR as well.

Pretty sure the MR is mergable, it might be the needs review bot not liking the revert of the revert.

Opened #3427298: Deprecate UserAuthInterface.

Good spot, that would have been annoying. Added the extra interface check - kept it in the one if clause so that it's easier to remove.

Applied the changes, although they didn't quite work, but close enough after some tidying.

Applied the suggestion on the MR and replied to the other thread.

Tagging this for release highlights - it's not much by itself but combined with other performance improvements could make up part of a decent paragraph.