fix(config): add rate limiting and constant-time comparison to reload endpoint

[bpamiri]

Summary

• Add IP-based rate limiting to the reload endpoint (?reload=true&password=xxx): 5 failed attempts within 5 minutes locks out the IP
• Replace Compare(Hash(...), Hash(...)) password check with MessageDigest.isEqual() for constant-time comparison, preventing timing attacks
• Log successful and failed reload attempts to wheels_security log file

Replicates the same proven pattern already used by the console eval endpoint (consoleeval.cfm).

Test plan

• Full test suite passes (2667 pass, 0 fail, 0 error on Lucee 7 + SQLite)
• Reload endpoint still works with correct password
• CI matrix validates across all engines

🤖 Generated with Claude Code