feat: limitador plugin

[maleck13]

Closes #152
Draft proposal plus POC code to prove out some of the assumptions. Introduces Limitador a plugin to PPE defines a rate limit plugin that can then be invoked

engine_settings:
  dispatch: policy

plugins:
  - name: app-ratelimit
    kind: ratelimit/limitador
    hooks: [http.request]
    mode: sequential
    capabilities: [read_subject, read_headers]
    config:
      namespace: toystore
      counter_capacity: 1000
      limits:
        - max: 5
          seconds: 60
          conditions: ["subject_id == 'alice'", "http_method == 'GET'"]
        - max: 2
          seconds: 60
          conditions: ["subject_id == 'bob'", "http_method == 'GET'"]

global:
  authorization:
    pre_invocation:
      - "run(app-ratelimit)"

Highly exprimental at the moment. But shows the intended direction

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[maleck13]

@didierofrivia interested in your thoughts on this proposal

[maleck13]

@araujof can move out of draft but wanted your throughts on the POC implementation and whether it is close to how we would actually want to do this?