Move new versions rate limits to the application

[pietroalbini]

This PR refactors the rate limiting code to support more kinds of rate limits, and moves the new versions rate limit from nginx to the application. See #3780 for the rationale of this change.

• The rate limiting for new publishes of existing crates is now tracked per-user instead of per-IP, with the ability to add overrides similar to the rate limiting for new crates. The limit is still the usual 1 version/min with a burst of 30, but in practice this could lower the rate limiting, as before the limit was between 30 and 60 depending how lucky users were with the load balancing.

• PublishRateLimit is now called RateLimiter, and for every operation it requires a LimitedAction. This allows different rate limits to exist for LimitedAction::PublishNew and LimitedAction::PublishExisting, and adding new kinds of rate limits only requires adding a new enum variant.

• The environment variables to override the default rate limits changed to RATE_LIMITING_{KIND}_RATE_SECONDS and RATE_LIMITING_{KIND}_BURST.

There are two things that will be done in followup PRs:

• Remove the default for the action column.
• Rename the publish_limit_buckets to rate_limit_buckets and publish_rate_overrides to rate_limit_overrides

[rust-highfive]

r? @jtgeibel

(rust-highfive has picked a reviewer for you, use r? to override)

[pietroalbini]

Sorry for the big PR, I tried making it easy to review the PR commit-by-commit.

[jtgeibel]

Looks great!

@bors r+

[bors]

📌 Commit 1a5b0e8 has been approved by jtgeibel

[bors]

⌛ Testing commit 1a5b0e8 with merge 1097171...

[bors]

☀️ Test successful - checks-actions
Approved by: jtgeibel
Pushing 1097171 to master...