Add a lifespan to the authentication failures data

Currently the data are never removed in case of authentication failure, except when the user managed to login.

It means that by default if a user makes 3 mistakes in his password in less that 5 minutes and tries several hours later to authenticate again, he'll still have to enter a CAPTCHA.

This looks a bit counter-productive, and can even be a problem in case of misconfigured component (cf https://forum.xwiki.org/t/captcha-not-being-displayed/5546/3)

I propose to define a configurable lifespan for those data, and to only consider the threshold reached in the given lifespan.