Add lockout protection to low brute force login

[r1kka6]

Summary

• move the Low brute-force form to POST so credentials are no longer submitted in the query string
• replace interpolated SQL with prepared statements and keep failure responses generic
• track failed logins server-side, lock an account after five failures for 15 minutes, and reset the counter after a successful login

Verification

• php -l passed for vulnerabilities/brute/index.php and vulnerabilities/brute/source/low.php
• vulnerable baseline still accepts the correct password immediately after six failed attempts and is also bypassable with username=admin' -- -
• patched runtime switches the Low form to POST, blocks the correct password after five failed attempts, keeps the active lockout window stable, allows login after the window expires, resets failed_login to 0, and rejects the SQLi bypass probe