ability to enable bruteforce protection for ExApp routes

[bigcat88]

<route>
	<url>^api\/w\/nextcloud\/jobs\/.*</url>
	<verb>GET,POST,PUT,DELETE</verb>
	<access_level>PUBLIC</access_level>
	<headers_to_exclude>[]</headers_to_exclude>
	<bruteforce_protection>[401, 500]</bruteforce_protection>
</route>

Looks like this. ExApps should not implement its own protection, we should provide a way to enable basic protection from Nextcloud/AppAPI side.