Implement some brute force protection

[t2d]

It seems reasonable to use a symfony package for that. What do you think about https://github.com/mariusbalcytis/gentle-force-bundle?

Privacy-implications should also be considered. We cannot do both things at the same time:

1. Only log unsuccessful attempts
2. Avoid that a botnet could try an account x times at the same moment, exceeding the max number of failed attempts.

[0x46616c6b]

We don't want to do that because we not want to handle real IP addresses in the service. For those use-cases something like CrowdSec should be used.