✨ Add basic per-user rate-limiting

[hardys]

Summary

This adds basic per-user rate-limiting, which can be tested by running alongside a sharded-test-server (on a different port to the existing proxy instance), e.g:

./bin/cps-front-proxy --mapping-file=.cps-front-proxy/mapping.yaml --root-directory=.cps-front-proxy --root-kubeconfig=$KCPDIR/.kcp/root.kubeconfig --client-ca-file=$KCPDIR/.kcp/client-ca.crt --tls-cert-file=$KCPDIR/.kcp-front-proxy/apiserver.crt --tls-private-key-file=$KCPDIR/.kcp-front-proxy/apiserver.key --secure-port=6453 --token-auth-file=$KCPDIR/test/e2e/framework/auth-tokens.csv --service-account-key-file=$KCPDIR/.kcp/service-account.crt --ratelimit-request-limit=1

Note .cps-front-proxy/mapping.yaml is just a copy of the KCP file, but with relative paths replaced with absolute ones

We can then see rate-limiting working here with the default ratelimit-burst-limit (5) we see something like this:

$ for i in $(seq 1 10); do curl --insecure https://localhost:6453 --header 'Authorization: Bearer user-2-token'; done
404 page not found
404 page not found
404 page not found
404 page not found
404 page not found
Too many requests, please try again later.
Too many requests, please try again later.
Too many requests, please try again later.
Too many requests, please try again later.
Too many requests, please try again later.

[hardys]

/cc @csams

[hardys]

I decoupled this from #3 since it seems we're still in the discussion phase with that, @csams I reused your options/config changes so added you as a co-author, PTAL :)

[stevekuznetsov]

Tiny nits, otherwise this looks good!

[stevekuznetsov]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: stevekuznetsov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [stevekuznetsov]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment