Document rate limiting for auth, passkeys, and form submissions

[jasonvarga]

Summary

Documents the named rate limiters added to Statamic 6.x in statamic/cms#14475.

• Adds a "Rate limiting" section to users.md covering the statamic.auth, statamic.cp.auth, statamic.passkeys, and statamic.cp.passkeys limiters, with defaults, route coverage, and an override example via RateLimiter::for() in AppServiceProvider. Explains that the CP limiters inherit from the front-end ones unless separately defined.
• Adds a "Rate limiting" section to forms.md covering the statamic.forms limiter (10/min default) and how to override it.

Notes

• [6.x] Improve rate limiting cms#14475 is still open as of writing — the limiter names and defaults may change before it's merged, so these docs may need a follow-up pass before publishing.
• The CMS PR's description mentions auth_middleware / forms_middleware config keys, but the actual implementation uses named Laravel rate limiters. This PR documents what the code actually does.

Test plan

• Confirm limiter names and defaults match what ships in 6.x once [6.x] Improve rate limiting cms#14475 is merged
• Render both pages locally and verify the new sections appear where expected