Security: Rate limit can be bypassed by setting created to a date in the past

Problem/Motivation

Opus 4.8 analysis:

 RateLimitPerUserValidator::isPostCountBelowLimit() counts existing entities in the window with:
  ->condition('uid', $uid)
  ->condition('created', $rate_limit_interval_start, '>=')
  created is a plain base field (LogJson.php:123) and is not marked internal/read-only in JSON:API (only id/uuid are — confirmed in
  core's ResourceTypeRepository). So a client with create log_json can set created to an old timestamp on every POST. Every stored row
  then falls outside the interval window, the count is always 0, and the rate limit never triggers — defeating the module's sole
  anti-DoS protection. The same applies to the REST endpoint.

  Fix: force created server-side (set it in preSave() / mark it read-only for the entity, or rate-limit on a server-trusted timestamp),
  or count by entity id/insert time rather than the user-supplied created.