Apply notes_create rate limit to draft note publish

What does this MR do and why?

Publishing draft notes creates notes without the notes_create rate limit that the notes endpoints already enforce. This MR applies it to the remaining publish entry points, with the same key, per-user scope and allowlist:

• PUT .../draft_notes/:draft_note_id/publish and POST .../draft_notes/bulk_publish (REST)
• POST .../approve with publish_review (REST)
• DraftsController#publish (the "Submit review" action in the merge request page)

Each charges one unit per draft note being published, plus one for a summary note, through the cost: option of the rate limiter. The charge is capped at notes_create_limit. Without the cap, a review with more drafts than the limit (for example 400 against 300 in the bulk publish API) could never be published. The check runs before anything is created, so a throttled publish leaves the drafts in place and can be retried after the period.

In the web action the 429 is JSON with a message key ("Too many notes have been created. Try again in 60 seconds."), so the review drawer shows it and not its generic error. The drawer publishes in batches of 20, so a review larger than the limit can be throttled partway. Publishing again after the period completes it.

Not covered here: quick actions that submit a review, and a limit on creating draft notes.

How to set up and validate locally

These steps cover the review drawer. The default limit is 300.

1. Lower the limit:

   bundle exec rails runner 'ApplicationSetting.current.update!(notes_create_limit: 3)'

2. In a merge request with changes, add 5 draft comments in the Changes tab.

3. Submit the review from the drawer. All 5 drafts publish.

4. Within a minute, add one more draft and submit again. The drawer shows "Too many notes have been created. Try again in 60 seconds." and the draft stays. After the minute the counter resets, so a later submit publishes it.

5. Restore the limit:

   bundle exec rails runner 'ApplicationSetting.current.update!(notes_create_limit: 300)'

References

Relates to https://gitlab.com/gitlab-org/gitlab/-/work_items/634354

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.