fix(accounts): a username longer than the field is refused by the login form

Django's login form gives the username its max_length after the field
is built, so a longer username was not refused and reached
authentication. django-axes then stored it in its 255-character column,
which PostgreSQL refuses: a login with a 300-character username was a
500 (SQLite does not enforce the length). Both login forms, with and
without OTP, now check the length, so such a username is a form error
and never reaches authentication, the lockout or the Logs page.

This also turns the PostgreSQL leg of CI green again: the S-16 test
from #167 hit exactly this.

accounts/tests/test_otp_login.py

@@ -167,6 +167,12 @@ class OTPLoginHTTPTestCase(TestCase):
         self._post(otp_token=token_for(device))
         self.assertEqual(self.messages(), ["Login"])
 
+    def test_an_oversized_username_is_refused_by_the_form(self):
+        response = self._post(username="x" * 300, otp_token="")
+        self.assertEqual(response.status_code, 200)
+        self.assertIn("username", response.context["form"].errors)
+        self.assertEqual(self.messages(), [])
+
     def test_a_signed_in_user_is_sent_on_from_the_login_page(self):
         from django.urls import reverse
         self.client.force_login(self.user)