GHSA-gqc5-xv7m-gcjq: Shopware has user enumeration via distinct error codes on Store API login endpoint

Shopware's Store API login endpoint leaks whether an email address is registered by returning different error codes: one code if the email doesn't exist and another if the password is wrong. An attacker can use this to enumerate valid customer accounts without needing to guess passwords, because they only need one request per email address. The storefront login page correctly hides this distinction by returning a generic error for both cases, but the Store API does not.