Add ReCAPTCHA support to password reset form

[asmecher]

The password reset form can generate unwanted emails if abused. Add ReCAPTCHA support to the password reset form.

[NateWr]

Since ReCAPTCHA is not available in China, can/should we do some basic rate limiting? If we log the reset request, we should be able to not send another reset request until the last one expires?

[henriqueramos]

As mentioned on Slack channel, we could use the hCaptcha instead reCaptcha.

[mfelczak]

Just wanted to add a +1 for rate limiting the password reset form.

[LuisLepidus]

+1

[henriqueramos]

@asmecher This feature its on dev roadmap? If not, I will spend some time creating this as a package.

[asmecher]

@henriqueramos, it hasn't yet been prioritized against a specific release, but I'd be happy to get a pull request reviewed!

[Godoy0722]

Hello @asmecher! Hope you're doing well.

I just created two PRs that are related to this issue. If you want to take a look or assign someone to make the code reviews, I would appreciate that!

[asmecher]

Looks good, @Godoy0722; can you forward-port this to stable-3_5_0, stable-3_4_0, and main? (If porting through stable-3_4_0 is too time-consuming, I'd consider leaving it out of that branch; stable-3_5_0 and main are basically equivalent.)

[Godoy0722]

Hello Alec! I'll work on it and ping you in the other PRs as soon as possible. I'll also link the PRs that I create with this one.