Add tests for username enumeration vulnerability

When creating a user account using an email that has already been taken,
or when logging in with an email that does not exist in the database,
the error messages should be generic and should not indicate that the
email already exists, or that the email does not exist (in the case of logins)

Here we are adding the tests for this behaviour.

test/controllers/registrations_controller_test.rb

@@ -143,4 +143,25 @@ def teardown
     end
     assert_response 401
   end
+
+  test "should return generic response when registering using an existing email" do
+    existing_user = create_user(email: '[email protected]')
+    p1 = random_complex_password
+
+    assert_no_difference 'User.count' do
+      post :create, params: { api_user: { password: p1, password_confirmation: p1, email: existing_user.email, login: 'test', name: 'Test' } }
+      assert_response 401
+      assert_equal 'Please check your email', response.parsed_body['message']
+    end
+  end
+
+  test "should return generic response when registering with non-existing email" do
+    p1 = random_complex_password
+
+    assert_no_difference 'User.count' do
+      post :create, params: { api_user: { password: p1, password_confirmation: p1, email: '[email protected]', login: 'test', name: 'Test' } }
+      assert_response 401
+      assert_equal 'Please check your email', response.parsed_body['message']
+    end
+  end
 end