feat: rework the OTP code submit count mechanism

[alnr]

Unlike what the previous comment suggested, incrementing and checking the submit count inside the database transaction is not actually optimal peformance- or security-wise.

We now check atomically increment and check the submit count as the first part of the operation, and abort as early as possible if we detect brute-forcing. This prevents a situation where the check works only on certain transaction isolation levels.

[codecov]

Codecov Report

Attention: Patch coverage is 88.23529% with 6 lines in your changes missing coverage. Please review.

Project coverage is 78.62%. Comparing base (d9f6f75) to head (b094bdc).
Report is 3 commits behind head on master.

Files with missing lines	Patch %	Lines
persistence/sql/persister_code.go	89.65%	2 Missing and 1 partial ⚠️
selfservice/strategy/code/test/persistence.go	87.50%	1 Missing and 1 partial ⚠️
identity/extension_verification.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4251   +/-   ##
=======================================
  Coverage   78.61%   78.62%           
=======================================
  Files         381      381           
  Lines       27318    27344   +26     
=======================================
+ Hits        21476    21498   +22     
- Misses       4223     4227    +4     
  Partials     1619     1619           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.