Add rate limiting on source IP to prevent DDoS

Let's make sure the threshold is high enough so we don't block things like VPN or university http proxies

I think we should try go down the HAProxy route first and perhaps have it per-site with the default disabled. The main reason being that we already generate the HAProxy config file used so should be more straight forward to implement vs. iptables where we'll then have to manage.

Also, I'm not sure what metrics the haproxy telegraf plugin exposes but it would be nice to extend it to support feeding the limits and existing connections metrics so we could alert when close to reaching said threshold.

We would very much appreciate this. We've been experiencing large spikes on searches on ubuntu.com from a few IPs - see https://portal.admin.canonical.com/C155805/ (Canonical internal) for reference.

We're experimenting with adding rudimentary rate limiting in our applications (https://github.com/canonical/canonicalwebteam.search/pull/33) but it would be much better to have this at the HTTP cache / CDN layer.

I also think have it off by default with the option to turn it on per site would make the most sense.

https://www.haproxy.com/blog/four-examples-of-haproxy-rate-limiting/:

"""
* Sliding Window Rate Limiting

frontend website
    bind :80
    stick-table type ipv6 size 100k expire 30s store http_req_rate(10s)
    http-request track-sc0 src
    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 20 }
    default_backend servers
"""