Add IP-based rate limiting for draft-creating form submissions

[dd32]

Summary

• Adds rate limiting (3 submissions/hour) for non-logged-in users on all Jetpack contact forms that create draft posts (call-for-speakers, call-for-sponsors, call-for-volunteers)
• Uses WordPress transients keyed by IP address to track submission counts
• Logged-in users bypass the rate limit entirely
• Returns a WP_Error via the jetpack_contact_form_is_spam filter when the limit is exceeded, with a message suggesting the user wait or log in

Context

Pentesters and bots have been spamming these forms with thousands of submissions (see montclair.wordcamp.org/2024 with 13,000+ spam entries), creating excessive draft speaker/session/sponsor/volunteer posts. This is a simple first line of defense as suggested in WordPress#1269.

Test plan

• Submit a form 3 times as a logged-out user — 4th submission should be rejected with rate limit message
• Verify logged-in users can submit unlimited times
• Verify the transient expires after 1 hour, allowing new submissions

Fixes WordPress#1269

🤖 Generated with Claude Code

[dd32]

There's an existing anti-spam form thing for this:

wordcamp.org/public_html/wp-content/mu-plugins/utilities/class-form-spam-prevention.php

Line 22 in a6db6e9

class Form_Spam_Prevention {