[Server] Implement Client Lockout

[romanett]

Proposed changes

This pull request introduces a client lockout mechanism to the OPC UA server to protect against brute-force authentication attempts. After a configurable number of failed authentication attempts, clients are temporarily locked out from further attempts. The implementation includes tracking failed attempts, enforcing lockout periods, and resetting counters after successful authentication. Comprehensive integration tests are also added to verify the new behavior.

Client Lockout Mechanism Implementation

• Added a lockout system in SessionManager to track failed authentication attempts per client using a new ClientLockoutInfo class and a ConcurrentDictionary. Clients are identified by certificate thumbprint, application URI, or secure channel ID. [1] [2]
• Enforced lockout policy in CreateSessionAsync: clients exceeding the allowed number of failures are denied access for a set duration, with warnings logged and informative error messages returned. Lockout state is checked and updated on each authentication attempt. [1] [2] [3] [4]

Related Issues

• Fixes [Server] Shall lock out Client Application after five failed attempts to validate a user Token #3523

Types of changes

• Bugfix (non-breaking change which fixes an issue)
• Enhancement (non-breaking change which adds functionality)
• Test enhancement (non-breaking change to increase test coverage)
• Breaking change (fix or feature that would cause existing functionality to not work as expected, requires version increase of Nuget packages)
• Documentation Update (if none of the other choices apply)

Checklist

• I have read the CONTRIBUTING doc.
• I have signed the CLA.
• I ran tests locally with my changes, all passed.
• I fixed all failing tests in the CI pipelines.
• I fixed all introduced issues with CodeQL and LGTM.
• I have added tests that prove my fix is effective or that my feature works and increased code coverage.
• I have added necessary documentation (if appropriate).
• Any dependent changes have been merged and published in downstream modules.

Further comments

The spec is not 100% accurate what to do, one sections says you shall lock out the client, one other suggest to delay responses instead.