Adding upgrading notes for brute force changes

Closes #31960

Signed-off-by: rmartinc <rmartinc@redhat.com>

docs/documentation/upgrading/topics/changes/changes-25_0_3.adoc

@@ -0,0 +1,10 @@
+= Concurrent login requests are blocked by default when brute force is enabled
+
+If an attacker launched many login attempts in parallel then the attacker could have more guesses at a password than the brute force protection configuration permits. This was due to the brute force check occurring before the brute force protector has locked the user. To prevent this race the Brute Force Protector now rejects all login attempts that occur while another login is in progress in the same server.
+
+If, for whatever reason, the new feature wants to be disabled there is a startup factory option:
+
+[source,bash]
+----
+bin/kc.[sh|bat] start --spi-brute-force-protector-default-brute-force-detector-allow-concurrent-requests=true
+----

docs/documentation/upgrading/topics/changes/changes.adoc

@@ -1,6 +1,10 @@
 [[migration-changes]]
 == Migration Changes
 
+=== Migrating to 25.0.3
+
+include::changes-25_0_3.adoc[leveloffset=3]
+
 === Migrating to 25.0.2
 
 include::changes-25_0_2.adoc[leveloffset=3]

services/src/main/java/org/keycloak/services/managers/DefaultBruteForceProtectorFactory.java

@@ -17,9 +17,12 @@
 
 package org.keycloak.services.managers;
 
+import java.util.List;
 import org.keycloak.Config;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakSessionFactory;
+import org.keycloak.provider.ProviderConfigProperty;
+import org.keycloak.provider.ProviderConfigurationBuilder;
 
 /**
  * @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
@@ -55,4 +58,16 @@ public class DefaultBruteForceProtectorFactory implements BruteForceProtectorFac
     public String getId() {
         return "default-brute-force-detector";
     }
+
+    @Override
+    public List<ProviderConfigProperty> getConfigMetadata() {
+        return ProviderConfigurationBuilder.create()
+                .property()
+                .name("allowConcurrentRequests")
+                .type("boolean")
+                .helpText("If concurrent logins are allowed by the brute force protection.")
+                .defaultValue(false)
+                .add()
+                .build();
+    }
 }