Create Bot_Management_and_Anti-Automation_Cheat_Sheet.md

[KadirArslan]

This PR contains new CS related to the Bot management.
Bots and AI traffics increased hugely. That's why I thought that It would be great to have single, actionable doc.

Please make sure that for your contribution:

• In case of a new Cheat Sheet, you have used the Cheat Sheet template.
• All the markdown files do not raise any validation policy violation, see the policy.
• All the markdown files follow these format rules.
• All your assets are stored in the assets folder.
• All the images used are in the PNG format.
• Any references to websites have been formatted as [TEXT](URL)
• You verified/tested the effectiveness of your contribution (e.g., the defensive code proposed is really an effective remediation? Please verify it works!).
• The CI build of your PR pass, see the build status here.

This PR fixes issue #2147 .

AI Tool Usage Disclosure (required for all PRs)

Please select one of the following options:

• I have NOT used any AI tool to generate the contents of this PR.
• I have used AI tools to generate the contents of this PR. I have verified
  the contents and I affirm the results. The LLM used is [llm name and version]
  and the prompt used is [your prompt here]. [Feel free to add more details if needed]

Thank you again for your contribution 😃

[mackowski]

This produces one 5-attempt bucket per (IP, username) pair, which means a single IP can try 5 attempts against an unlimited number of usernames before any limit fires right?

[jmanico]

• Rate limiter keyGenerator (line ~76): As @mackowski noted, 'login:${req.ip}:${req.body?.username ?? 'anon'}' creates one bucket per (IP, username) pair, so a single IP can attempt 5 passwords against unlimited usernames before any limit fires. This also contradicts your own guidance further down ("Apply per-username and per-IP limits with separate windows").

I suggest you drop the code and just describe the control, please.

Also:

• "Google Web Environment Integrity successors" WEI was withdrawn in 2023 with no shipped successor. Suggest dropping or replacing with "emerging device-attestation APIs."
• References list: "Multifactor Authentication Cheat_Sheet" → "Multifactor Authentication Cheat Sheet" (underscore typo in display text).

[KadirArslan]

Thanks @mackowski and @jmanico for the careful review

Rate limiter: I've removed the code block entirely as suggested
WEI: Replaced "Google Web Environment Integrity successors" with "emerging device-attestation APIs." You're right that WEI was withdrawn in 2023.
Typo: Fixed.

Pushed the latest commit.