Add `lockable` option to password strategy

[sevenseacat]

To lock the user account after a set number of failed sign in attempts.

Config:

• Number of failed attempts to lock after
• Lock duration

From Slack:

You could have a resource for tracking login attempts, could store that in ETS, and then store locked_until on the user, and then add some logic to the action to check if that username has been locked before running the query, and if so return a locked error.