Missing flood control in password reset routes

Problem/Motivation

Drupal core has a rate limiting / flood control vulnerability in 2 password reset routes:
* user.pass.http
* user.reset.login

It was decided by the Drupal security team that this can be posted a public security improvement and does not need a private security issue.

Steps to reproduce

An attacker can trigger thousands of emails being sent out for password reset purposes. They never get rate limited per email address.

Proposed resolution

Implement flood control so that only 5 password reset emails can get triggered per hour.

Remaining tasks

Implement proposal in merge request.

Decide if we should show a new error message to the user or silently skip email sending. Silently skipping would have the advantage that an attacker cannot easily know the rate limit. On the other hand for testing it can be very confusing if there is a success message but no email is sent.

User interface changes

Maybe: a new error message string when the user has exceeded the rate limit

Introduced terminology

none?

API changes

none

Data model changes

none

Release notes snippet

to be done