server: add RCON lockout after repeated failed attempts

[Crimewavez]

This change adds a simple per-IP RCON authentication lockout on top of the existing rate-limiting logic.

• After 3 consecutive bad RCON passwords from a given IP, that IP is locked out from RCON for 60 seconds.
• While locked, all RCON packets from that IP are dropped early including ones with the correct password.
• Once the lock duration expires, RCON from that IP is accepted again as normal.
• Existing SVC_RateLimitAddress and SVC_RateLimit behavior is unchanged.

The goal is to make brute-forcing the RCON password significantly harder without changing behavior for other connectionless traffic (getstatus, getinfo, etc).

---

Current engine behavior uses a leaky bucket via SVC_RateLimitAddress (per-address) and SVC_RateLimit (global) to:

• throttle connectionless packets (DoS protection),
• throttle RCON traffic.

This prevents a single IP from spamming RCON indefinitely, but it does not strictly limit how many password guesses an attacker can make over time, as long as they stay under the burst/period thresholds.

A lockout after a small number of failures is a standard way to make brute-force/dictionary attacks impractical, even when the attacker stays within the pure packet rate limits.

---

Locally verified with:

• Server and client on the same host.
• rconpassword set and developer 1 enabled.

From a single IP:
3 incorrect RCON attempts equal in lock message for that IP and 60 seconds of RCON being ignored.

During lock:
Additional incorrect RCON attempts produce “rcon locked …” debug messages and do not reach the password handling. Correct RCON attempts are also ignored until the lock expires.

After ~60 seconds:
Correct RCON requests are accepted again; command output appears as usual.

With multiple IPs on loopback:

Adding a second local IP (e.g. 10.0.0.2) and connecting from it:

• Lock on 127.0.0.1 does not affect RCON usage from 10.0.0.2.
• Each IP’s lockout state behaves independently.

[llbraughler]

Per style guide, leave out username tags in commits

[Crimewavez]

Removed the user tag from the code as requested.