Allow identity providers to reset brute force login failures on login - #53724

Closes #53249

Since #49996, the brute force failure count is only reset by a successful login that used a password, OTP, or recovery code. That fixed cookie SSO re-authentication resetting the count (#49960), but it also means a successful brokered login (SAML, OIDC, social) never resets it. Users who mostly sign in through an identity provider keep accumulating failures from occasional mistyped local passwords until they are locked out.

Resetting on every brokered login would reopen #49960, because an identity provider can complete a login without the user entering anything (from an existing session at the provider). This PR makes the reset opt-in per identity provider:

• New identity provider setting resetLoginFailures (admin console: Advanced settings > "Reset brute force failures on login"). Off by default, so existing behavior is unchanged.
• When enabled, AuthenticationManager.logSuccess() passes an identity-provider category to the brute force protector for logins completed through that provider, and the failure count is reset the same way as after a password login.
• The check uses the IDENTITY_PROVIDER user session note set in finishBrokerAuthentication(), so later cookie-based SSO re-authentication still does not reset the count, even with the setting on.

I went with a per-provider setting since trust differs between providers, and it needs no schema changes. Happy to move it to a realm-level setting if you'd prefer.

Tests: three new tests in AbstractAdvancedBrokerTest (runs for SAML, OIDC, and OAuth2 brokering):

• loginWithBrokerDoesNotResetBruteForceFailureCountByDefault: count stays at 1 after a brokered login with the setting off
• loginWithBrokerResetsBruteForceFailureCountWhenEnabled: count resets to 0 with the setting on
• loginWithBrokerThenCookieSsoDoesNotResetBruteForceFailureCount: with the setting on, cookie SSO re-authentication on a session created through the identity provider does not reset the count (Brute-force detection: Authenticated session token refresh resets lockout counter #49960)

Ran locally for KcSamlBrokerTest and KcOidcBrokerTest.

Docs: identity provider general configuration table and the brute force detection page.

AI disclosure: I used Claude to help test, and review old PRs. I reviewed, built, and tested all changes.