MM-55320 - Limit length of browser user agent version; ratelimit the /sessions endpoint (#25900)

* add ratelimit to /sessions; cap userAgent version length; tests

* add MaxSessionsLimit; remove oldest session first; tests

* can't use slices in 1.20; improve test

* nits

* add GetLRUSessions; move limiting to CreateSession; remove rate limiting

* use queryBuilder

* mysql needs a limit when using offset

* update i18n

* refactor into limitNumberOfSessions; protect createSessionForUserAccessToken

* add comment to GetLRUSessions

* add limit to oauth path; PR comments

server/channels/store/sqlstore/session_store.go

@@ -123,6 +123,28 @@ func (me SqlSessionStore) GetSessions(c request.CTX, userId string) ([]*model.Se
 	return sessions, nil
 }
 
+// GetLRUSessions gets the Least Recently Used sessions from the store. Note: the use of limit and offset
+// are intentional; they are hardcoded from the app layer (i.e., will not result in a non-performant query).
+func (me SqlSessionStore) GetLRUSessions(c request.CTX, userId string, limit uint64, offset uint64) ([]*model.Session, error) {
+	builder := me.getQueryBuilder().
+		Select("*").
+		From("Sessions").
+		Where(sq.Eq{"UserId": userId}).
+		OrderBy("LastActivityAt DESC").
+		Limit(limit).
+		Offset(offset)
+	query, args, err := builder.ToSql()
+	if err != nil {
+		return nil, errors.Wrap(err, "get_lru_sessions_tosql")
+	}
+
+	var sessions []*model.Session
+	if err := me.GetReplicaX().Select(&sessions, query, args...); err != nil {
+		return nil, errors.Wrapf(err, "failed to find Sessions with userId=%s", userId)
+	}
+	return sessions, nil
+}
+
 func (me SqlSessionStore) GetSessionsWithActiveDeviceIds(userId string) ([]*model.Session, error) {
 	query :=
 		`SELECT *