Ability to protect the button entity with a PIN code/password

**Describe the problem you have/What new integration you would like**
I know I can get around this with tricks in Lovelace, but a more deeply implemented behavior would be much more secure than popping a JS box to enter a PIN or passphrase.

The idea is to have an ability to add a property to a `button` entity to make it protected. In a way that, when called either from Lovelace, or via API, it would require a PIN or password be provided, in order to execute the action.

This is a more involved fuature request, of course, as it goes a bit deeper into entities and requires a change also in frontend (to provide a pop-up). But I think it's uhm... kind of due :) at least for a button. I would likely try to provide a pull request if I understood how to code in C...

**Please describe your use case for this integration and alternatives you've tried:**
A real life use case: I have a door with a smart lock (that uses a biometric sensor to open the lock). The door controller has an input, that I can connect to a pushbutton to provide a way to unlock the lock from some other place in the house, without having to go downstairs. So I can place a relay connected to an esphome node, then I can pretty much do it from anywhere. Cool ! That's great.

But, that also means anyone with access to HA UI can simply puch the button and unlock the door. My kid can grab my mobile or tablet and push this button while we're far away from home. For some entities it makes a lot of sense to put a PIN prompt in home assistant. So, I could have button to unlock my main door, or remotely open the gates from 1000 km away -> but I'd fell a lot better knowing that I also need to enter the right PIN when doing that.

Because... Unlocking the house is not the same thing as turning on a light.

Perhaps there is some way to do this already, but I searched and haven't found a good way. I did find some Lovelace-based PIN prompts, but those are not secure enough, they rely on the UI bloking your way in, not the actual PIN -> that could, in the backend, have fail counts, lock-outs, avoiding brute force attacks, etc -> making this quite secure.

If it would only exist for a button, nothing elase, it would be more than great !

**Additional context**

Start by tracing how button entities are invoked through the API and from Lovelace, as the request explicitly requires protection in both paths. Define how PIN or password validation, failed-attempt handling, and lockouts should work, then confirm that an authorized action cannot execute without valid credentials.

Written by the indexing model from the issue text.