Brute-force protection bypass via login counter race

Authentication rate-limit bypass in Wazuh 4.0.0 through 4.14.3 allows remote attackers to exceed password-guess limits via concurrent logins. The prevent_bruteforce_attack function checks and updates the shared ip_stats and ip_block collections without atomic synchronization, so parallel requests pass the limit check before their counters are updated. Exploitation requires network access to the server API and a valid username; it permits extra password guesses but does not itself disclose credentials or guarantee account access.