Implement rate limiting for the API endpoint

This will throw a 429 if haproxy tracks more than 10 req/s to /api/ from the same client ip address.

Closes https://gitlab.com/gitlab-com/infrastructure/issues/1469

/cc @pcarranza @jtevnan