fix(security): throttle failed student password reset answer attempts

[Isaries]

Summary

The student password reset compared the security answer in plain text with no limit on attempts. Because these answers are low entropy, an attacker could brute force the answer and take over a student account. This adds throttling that matches the approach the teacher password reset flow already uses.

Changes

• Block the reset after a small number of failed answers within a short window (5 attempts within 10 minutes) on both the security answer step and the password change step.
• Reuse the existing failed verification attempt fields on the user details, so there is no database migration.

Paired change

This is paired with a WISE-Client change (branch fix/student-reset-throttle) that displays a message for the new throttling response code.

Testing

• Builds on JDK 17 (mvnw package).

[Isaries]

Paired client change: WISE-Community/WISE-Client#2325

[Aaron-Detre]

I made one minor suggestion, but the feature works as described, and the code looks good.

[Isaries]

Thanks for the review @Aaron-Detre. I have applied your suggestion for isTooManyFailedAnswerAttempts, and the build is green, so this should be ready to merge.

Two notes on the design, for the record:

• The counter reuses the teacher verification-code fields (recentFailedVerificationCodeAttemptTime / numberOfRecentFailedVerificationCodeAttempts). This is safe because students never obtain a verification code (that path is teacher-only and requires an emailed code), so the two flows write these fields for disjoint sets of accounts, and it avoids a migration. The counter is also cleared on a correct answer and on a successful password change, so a legitimate reset leaves no stale throttle state.

• One intentional deviation from the teacher flow: the student step checks isTooManyFailedAnswerAttempts before recording the attempt (check-then-record), whereas the teacher verification-code step increments before checking. The practical effect is that the student flow allows one more failed guess (blocks on the 6th vs the teacher's 5th) before the same 5-attempt / 10-minute window applies. Happy to align it to increment-first if you would prefer exact parity.

Paired client change: WISE-Community/WISE-Client#2325