Fix CWE-307 - Insufficient Rate Limiting on Authentication Attempts

[kolega-dev-github-app]

Summary

This PR addresses the security vulnerability CWE-307 (Insufficient Rate Limiting on Authentication Attempts) in the OpenClaw Gateway authentication system. It implements a robust rate limiting solution to prevent brute force attacks against authentication tokens and passwords.

Changes

• Implemented a core rate limiter module with IP-based tracking, sliding window rate limiting, exponential backoff, and other security features
• Integrated the rate limiter into the Gateway's HTTP server, applying limits at multiple layers (early middleware, endpoint-specific, authentication backoff)
• Enhanced the authorizeGatewayConnect function to record failed attempts and trigger exponential backoff
• Updated all authentication-requiring HTTP handlers to include rate limiting

Testing

The rate limiting implementation has been thoroughly tested, including unit tests for the core rate limiter module and integration tests for the HTTP server and authentication flows.