Add the option to protect the login form

I updated for 2.1.x.
On Git, honeypot.settings already included this:

unprotected_forms:
  - 'user_login_form'

I updated the form to include user_login_form.

If you have a distribution like Social, the form Id for the user/login page might be different:
id="social-user-login-form"

How would one manually test this?

At a minimum, we need test cases for this. HoneypotFormTest already explicitly tests that the user_login_form is not protected, so that test should be expanded to toggle the protection then test that it becomes protected. That will ensure the feature continues to work properly.