Authentication throttling bypass via attacker-controlled email key

Rate-limit bypass in Strapi before 5.45.0 allows remote attackers to evade per-IP throttling on authentication routes. The users-permissions middleware adds ctx.request.body.email to its key even on routes that do not accept email, so rotating that field creates a fresh quota. Unauthenticated network access to enabled authentication routes permits high-volume password guessing, reset-code brute force, and credential stuffing.