fix(security): implement rate limiting to prevent brute force attacks

[FaizanKolega]

• Replace stub guard implementations with ThrottlerGuard extensions
• Add ThrottlerModule with Redis support and in-memory fallback
• Configure default rate limits: Data API (100 req/min), Meta API (50 req/min), Public API (10 req/min)
• Apply stricter limits for authentication endpoints (5 req/min, 15-min block)
• Add NC_THROTTLER_* environment variables for customization
• Implement granular tracking: IP + user + base/workspace for different API types
• Add special handling for critical auth endpoints (signin, signup, password reset, token validation)

Fixes rate limiting vulnerabilities in authentication, data export, job endpoints, and public APIs.

Change Summary

Implements rate limiting across all API endpoints to prevent brute force attacks and DoS vulnerabilities. Replaces stub guard implementations (DataApiLimiterGuard, MetaApiLimiterGuard, PublicApiLimiterGuard) with functional ThrottlerGuard extensions.

Fixes:

• Vulnerabilities Resource value showing as undefined nocodb/nocodb#41, #42, Issue when xmysql container startup is before mysql container startup nocodb/nocodb#43: No rate limiting in guard implementations
• Vulnerability #57: Missing rate limiting on job endpoints
• Vulnerability #73: Missing rate limiting on password reset token validation

Change type

• feat: (new feature for the user, not a new feature for build script)
• fix: (bug fix for the user, not a fix to a build script)
• docs: (changes to the documentation)
• style: (formatting, missing semi colons, etc; no production code change)
• refactor: (refactoring production code, eg. renaming a variable)
• test: (adding missing tests, refactoring tests; no production code change)
• chore: (updating grunt tasks etc; no production code change)

Test/ Verification

Authentication brute force protection:

# Attempt 6 logins - 6th should return 429 (Too Many Requests)
for i in {1..6}; do
  curl -X POST http://localhost:8080/auth/user/signin \
    -H "Content-Type: application/json" \
    -d '{"email":"test@example.com","password":"wrong"}'
done

Verify rate limits are enforced:

• Auth endpoints: 5 requests/min, 15-min block
• Data API: 100 requests/min
• Meta API: 50 requests/min
• Public API: 10 requests/min

Check logs for throttler initialization:

Throttler: Using in-memory storage

Additional information / screenshots (optional)

Default configuration:

• Rate limiting is enabled by default using in-memory storage
• For multi-instance deployments, set NC_THROTTLER_REDIS=redis://host:port/db for distributed rate limiting
• All limits customizable via NC_THROTTLER_* environment variables
• Leverages existing @nestjs/throttler package already in dependencies
• ThrottlerException handling already implemented in GlobalExceptionFilter
• No breaking changes - backward compatible with existing deployments