Add constraints for maximum control actuation rates to prevent over-actuation

[danieldyer]

Currently there's no limit to the rate of change of calculated control inputs. It shouldn't be a problem when everything's behaving normally, but it would help the solver take things like throttle ramp rates into account to improve the solution, and would add an extra safeguard against uncontrolled oscillation if the QP is unable to be solved for whatever reason.