Login throttling also applies to the HTTP API, cannot be disabled, fails without rate limiter #229

Regression of 3.4 (#207, #222).

The login_throttling added to the main firewall also applies to the HTTP API (HttpProcessExecutionAuthenticator is on the same firewall and its passport has a UserBadge):

• after 5 failed logins with the email of the API user from the same IP address, the API answers 401 {"message":""} even with a valid token (the message of TooManyLoginAttemptsAuthenticationException is empty);
• 25 API calls with a wrong token (e.g. a cron job whose token has been regenerated) block the login form for every user of this IP address.

Behind a reverse proxy without trusted_proxies, or a NAT, all the requests share the same IP address.

Also:

• login_throttling: false on the main firewall of the application is ignored (the bundle configuration is merged after it): the only way out is configure_firewall: false;
• with framework.rate_limiter: false, the container cannot be compiled: Service "limiter._login_local_main": Parent definition "limiter" does not exist.

Fix: the HTTP API requests are not throttled; onAuthenticationFailure() returns the message key of the exception; the bundle does not enable the throttling when the application disables it, and gives an explicit error when the rate limiter is disabled.

Found during the audit after the 3.4 release (audit-v4-post-release.md #217, #223).