Auth Rate Limits by email address (or Supabase user ID) instead of by IP address

Hi! We have recently had a Pentest carried out on our product and one of the critical issues raised was the apparent absence of rate limits on the /auth/v1/token (the one used for logging in). The pentesters were able to brute force a user account through repeated password guessing attempts despite the default Auth Api rate limits enforced by Supabase. Feature Request Rate limits for non-anonymous requests, such as login requests for a specific user account, should be limited by the Supabase user trying to login rather than by the IP address the request is coming from. This way using different IP addresses to brute force the same account would be unfeasible and, as a bonus, people sharing the same IP address would not risk limiting each other while trying to access different accounts. This would also allow to make the rate limit a lot smaller since less attempts can reasonably be expected for each user account. It would be interesting to hear other people thoughts on the m…