fix: forgot password email DDP method doesn't have strict rate limits (#41857)

Co-authored-by: Julio Araujo <julio.araujo@rocket.chat>

Author: dionisio-bot[bot]

.changeset/fuzzy-ends-refuse.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Adds per-client rate limiting to the unauthenticated sendForgotPasswordEmail method, matching the REST users.forgotPassword endpoint

apps/meteor/server/methods/sendForgotPasswordEmail.ts

@@ -2,6 +2,7 @@ import type { ServerMethods } from '@rocket.chat/ddp-client';
 import { Users } from '@rocket.chat/models';
 import { Accounts } from 'meteor/accounts-base';
 import { check } from 'meteor/check';
+import { DDPRateLimiter } from 'meteor/ddp-rate-limiter';
 import { Meteor } from 'meteor/meteor';
 
 import { settings } from '../../app/settings/server';
@@ -44,3 +45,15 @@ Meteor.methods<ServerMethods>({
 		return sendForgotPasswordEmail(to);
 	},
 });
+
+DDPRateLimiter.addRule(
+	{
+		type: 'method',
+		name: 'sendForgotPasswordEmail',
+		clientAddress() {
+			return true;
+		},
+	},
+	10,
+	60000,
+);