[Hardening] F-15: Failure to Block Abusers by IPs.

### The required feature described as a wish

**Description:** CloudStack does not monitor or restrict API authentication attempts based on the source IP address. A single client can submit unlimited failed authentication attempts across any number of accounts without being identified or blocked.

**Affected Components:** Management API

**Impact:** An attacker operating from a single source address can systematically target multiple user accounts with repeated failed login attempts, deliberately triggering lockouts across all accounts, preventing legitimate users and administrators from accessing the platform.

**Steps to Reproduce:**
- Using a custom script or a brute-forcing tool (e.g., `hydra`), send a high volume of failed authentication attempts targeting multiple user accounts.
- Observe that the requests are processed without any source IP tracking, flagging, or blocking.
- Confirm that targeted accounts transition to a disabled state while the source IP remains unrestricted.

**Recommended Remediation:** Log all authentication attempts and source IPs to `/var/log/cloudstack/management/auth.log` so tools like Fail2Ban can automatically detect brute-force attacks and block malicious traffic (via `iptables` or `nftables`). For even faster protection, a system administrator can craft a custom script using `inotify` to trigger real-time blocks via network edge appliances, stopping attackers' traffic before they ever reach CloudStack.

CloudStack Management API の認証フローから始め、失敗した試行と送信元 IP をどこで確認できるかを特定します。提案されている /var/log/cloudstack/management/auth.log への出力を想定される統合ポイントとして使用し、その後、カスタムスクリプトまたは hydra で攻撃を再現して、Fail2Ban がブロックに使用できる形式で試行が記録されることを確認します。

索引モデルが issue の本文から書いたものです。