Account lockout policy

[steinkel]

New feature to lock a users account after a number of failed password attempts in a certain time window. See https://pcidssguide.com/pci-dss-requirement-8/ 8.1.6 and 8.1.7

• The feature would be optional, by default disabled
• The number of attempts would be configurable, for example 6 failed attempts
• The lock time would be configurable, for example, lock for 5 minutes
• The time window would be configurable, for example, 5 minutes.
• We will not display any additional warning to the user, use the same output as a failed password attempt it the account is locked

[rochamarcelo]

Pull request sent, we can close this.