[SECURITY] Prevent time based information disclosure

To prevent a time based information disclosure in backend password reset,
this patch adds a random delay between 200 milliseconds and 3 seconds
before sending the response to the client.

Resolves: #91243
Releases: master
Change-Id: I0362db283145e0bed414ecdb06fff81b2cff0d4b
Security-Bulletin: TYPO3-CORE-SA-2020-001
Security-References: CVE-2020-11063
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/64466


Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>