Add rate limiting to API calls

[spwoodcock]

Is your feature request related to a problem? Please describe.

• After we add a task queue, Redis will be part of our stack.
• We can also use Redis to effectively handle rate limiting.

Describe the solution you'd like

• Rate limiting should be implementing based on:
  • Number of requests from an IP address per minute.
  • Possibly total number of requests per minute to avoid DDOS?

Describe alternatives you've considered

• We could add something like fail2ban to the Nginx proxy, which isn't a bad idea.

Additional context

• For most endpoint we are protected by login_required, making distributed attacks harder.
• But we do have some unprotected endpoints out of necessity, so this is a moot point.

[spwoodcock]

While Redis based rate limiting is the best approach with good granularity, if we do not implement a task queue then there isn't much point adding Redis to the stack.

In this case, basic rate limiting via the Nginx proxy is the best approach. This should be explored.

Another alternative would be the implementation from litestar: https://docs.litestar.dev/2/usage/middleware/builtin-middleware.html#rate-limit-middleware based on RateLimit header fields spec