Use the `last_attempt_warning` configuration with the lockable unauthenticated_message message.

This configuration was added in #2687 but it was never used in the real code that
defines what message should be used by the app.
`last_attempt_warning` should be `true` for now on.
Update CHANGELOG
Merge pull request #3239 from plataformatec/lm-last_attempt_warning

Use the `last_attempt_warning` configuration with the lockable unauthenticated_message message.