Add user_failed_login_identifier_uid_only to form

Attaching a patch for this feature.

I think this is probably out of scope for this particular project, but it might make sense as a feature request for cbp (which uses this module here as a dependency for the flood settings themselves).

RTBC from me. It makes sense to expose the ability to configure the flood logging identifier in flood_control. However, attaching a re-roll to make things go easier. The current patch didn't want to apply cleanly.

RTBC++ thanks for fixing the patch. The trick looks like #1 forgot --relative flag when creating the patch inside their drupal site.

+    '#description' => t('When enabled, register failed login events based on the uid only, so they apply for any IP address. This is the most secure option.'),

Maybe it would be good to explain this in a way that explains both the pros and cons. For example, from the code comments in Drupal core about this, if you read both code comments you can get a sense of the relative pros/cons:

      if (variable_get('user_failed_login_identifier_uid_only', FALSE)) {
        // Register flood events based on the uid only, so they apply for any
        // IP address. This is the most secure option.
        $identifier = $account->uid;
      }
      else {
        // The default identifier is a combination of uid and IP address. This
        // is less secure but more resistant to denial-of-service attacks that
        // could lock out all users with public user names.
        $identifier = $account->uid . '-' . ip_address();
      }

I close this because it is a request for the 7.x version.