Rate limit repository file blame requests

Jerry Setorequested to merge
618765-rate-limit-blame-api into master

What does this MR do and why?

Limit GET /projects/:id/repository/files/:file_path/blame to 400 requests per minute per user and project, or per IP when anonymous.

Graphql handled in a separate MR: Rate limit the GraphQL blame field (!262233 - merged)

References

Relevant investigation: https://gitlab.com/gitlab-org/gitlab/-/work_items/618765#note_3986975388

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #618765

Edited by Jerry Seto

Merge request reports