Also punish failed logins via GET and URL-token

Signed-off-by: Pablo Zmdl <pablo@nextcloud.com>

php/src/Controller/LoginController.php

@@ -42,6 +42,9 @@ readonly class LoginController {
             return $response->withHeader('Location', '../..')->withStatus(302);
         }
 
+        // Punish failed auth attempts with a delay, as a very simple means against bots.
+        sleep(5);
+
         return $response->withHeader('Location', '../..')->withStatus(302);
     }