Add rate limiting to login requests

[jayjay-w]

Description

Add rate limiting to login requests using rack-attack. As a starting point, we are setting a limit of 5 request per minute to /api/users/sign_in.

References: CV2-4164

How has this been tested?

Tested by confirming that:

• Repeated calls to /api/users/sign_in will result in a 429: Too many requests error. This can be validated using both the check web application or an api client. . The default limit is 10 requests per minute.
• Repeated calls to /api/graphql will result in a 429 error as well. The default limit is 100 requests per minute.

Things to pay attention to during code review

Checklist

• I have performed a self-review of my own code
• I have added unit and feature tests, if the PR implements a new feature or otherwise would benefit from additional testing
• I have added regression tests, if the PR fixes a bug
• I have added logging, exception reporting, and custom tracing with any additional information required for debugging
• I considered secure coding practices when writing this code. Any security concerns are noted above.
• I have commented my code in hard-to-understand areas, if any
• I have made needed changes to the README
• My changes generate no new warnings
• If I added a third party module, I included a rationale for doing so and followed our current guidelines

[caiosba]

There is a typo, but after I fixed it locally, I was able to verify both features:

• User account locked after failed login attempts
• Rate limit error when many calls are made to the GraphQL API endpoint

FYI @jayjay-w: You don't need to explicitly call .to_i when retrieving a configuration value... you can pass a :integer parameter to CheckConfig.get: https://github.com/meedan/check-api/blob/develop/app/lib/check_config.rb#L10

[codeclimate]

Code Climate has analyzed commit 4b03a98 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (100% is the threshold).

This pull request will bring the total coverage in the repository to 99.9% (0.0% change).

View more on Code Climate.

[caiosba]

hey @jayjay-w , there was a failed test :)

Error:
SessionsControllerTest#test_should_unlock_locked_user_accounts_after_specified_time:
TypeError: ActiveSupport::TimeWithZone can't be coerced into Integer
    test/controllers/sessions_controller_test.rb:97:in `+'
    test/controllers/sessions_controller_test.rb:97:in `block in <class:SessionsControllerTest>'

[jayjay-w]

Interesting...@caiosba I will fix it in a new PR.