Rate limiter

[andrew4699]

Description

Adds a rate limiter to protect against DoS-style attacks.

There are 3 implementations to choose from:

• DefaultRateLimiter which uses the OpenTelemetry token bucket implementation
• NoOpRateLimiter which does no rate limiting
• MockRateLimiter which comes with a MockClock that can be used in tests

Implementations are dynamically discoverable through META-INF and there are interfaces so you can plug your own.

Type of change

• New feature (non-breaking change which adds functionality)

How Has This Been Tested?

• Existing integration tests work with a rate limiter configured
• New rate limiter integration tests
• Manual testing

Checklist:

• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings

[snazy]

Thanks for the contribution @andrew4699!

Adding protections to the service is a great thing! However, I see a couple of issues with the approach, added a couple of comments to this PR. It's mostly about concurrency and blocking behavior.

[snazy]

Thanks for refactoring the CHM stuff - that's much cleaner and safer IMO.

I'm generally okay with this change.
Wonder though whether Guava's RateLimiter would fit the needs though - but I don't see it as a blocker for this PR.

I'll be somewhat unavailable in the next couple of days, so if there's anybody else who can review as well and happy with it, I'm okay with merging.

[snazy]

Those doubles could all be longs.

I wonder though whether com.google.common.util.concurrent.RateLimiter wouldn't satisfy the need as well. Using the Guava one could save some testing pain ;) OTOH it uses Guava's clock/watch stuff.

[andrew4699]

I was looking into the different rate limiters that are already pulled in by our dependencies and did see that one, however it doesn't seem to support a custom window size. I had originally pulled in the OpenTelemetry one because it was basically equivalent to what I wanted, but didn't realize that it was an internal package. I figured since the implementation is small enough, it was better to just implement it than to try finding a new library for it.

[andrew4699]

Updated most of the doubles to longs.

[mrcnc]

LGTM