Password cookie expiry

You should not modify wp-login.php itself. Add a filter to modify the expiration value. For example, this works for me in functions.php:

function Modif_expir_cookie( $time ) { 
  return 0;
}
add_filter('post_password_expires', 'Modif_expir_cookie' );

(modified from the user note on the doc page you linked)

Apologies for lack of clarity. Yes, functions.php of the theme. However, if your theme is subject to periodic updates, you should not modify it either. Instead, you could create a child theme and place PHP code in its functions.php.

Creating a child theme is a bit of a fuss. If you are not modifying templates and just adding PHP code, it’s actually easier to create a small custom plugin to contain the code. You can also add any other custom code you decide to use in the future to the same plugin.

The code in question is PHP and will only create a syntax error if placed within the customzer’s Additional CSS section. There are established “snippets” plugins that will let you safely add PHP snippets to the site. Personally I don’t see the point since creating a custom plugin is relatively easy, but some people prefer these snippets plugins or they wouldn’t be used in many thousands of installations.