Add Rate Limiting to TOTP related routes

[pano9000]

Describe feature

Add Rate Limiting to Login related routes, to make brute forcing a lot less practicable

Additional Information

No response

[pano9000]

loginRateLimiter for the /login route itself is already there:

    const loginRateLimiter = rateLimit({
        windowMs: 15 * 60 * 1000, // 15 minutes
        max: 10, // limit each IP to 10 requests per windowMs
        skipSuccessfulRequests: true // successful auth to rate-limited ETAPI routes isn't counted. However, successful auth to /login is still counted!
    });

    route(PST, "/login", [loginRateLimiter], loginRoute.login);

however it is not applied to the totp related routes → we need to check, for which routes it would make sense here:

   apiRoute(GET, '/api/totp/generate', totp.generateSecret);
    apiRoute(GET, '/api/totp/status', totp.getTOTPStatus);
    apiRoute(GET, '/api/totp/get', totp.getSecret);

    apiRoute(GET, '/api/oauth/status', openID.getOAuthStatus);
    apiRoute(GET, '/api/oauth/validate', openID.isTokenValid);

    apiRoute(PST, '/api/totp_recovery/set', recoveryCodes.setRecoveryCodes);
    apiRoute(PST, '/api/totp_recovery/verify', recoveryCodes.verifyRecoveryCode);
    apiRoute(GET, '/api/totp_recovery/generate', recoveryCodes.generateRecoveryCodes);
    apiRoute(GET, '/api/totp_recovery/enabled', recoveryCodes.checkForRecoveryKeys);
    apiRoute(GET, '/api/totp_recovery/used', recoveryCodes.getUsedRecoveryCodes);