feat(v2/ratelimit): add rules-based rate limiting package

What does this MR do?

Adds v2/ratelimit: rules-based rate limiting on Redis fixed-window counters for the Go SDK, implementing the cross-SDK rate-limit contract:

• Byte-identical Lua scripts (shared EVALSHA digests) and Redis key shape labkit:rl:{...}[:ban], _unknown_ sentinel, SHA-256 encoding for characteristic values >200 chars
• gitlab_labkit_rate_limiter_* Prometheus metric families, distinguished per limiter by the rate_limiter label
• Canonical WARN log lines (rate_limit_error, rate_limit_missing_count_distinct) with class_name/error_message fields

A Limiter is built once per call site from an ordered rule list (limit/log/skip actions; Eq/Re/OneOf matchers; per-characteristic counters; count-distinct via Redis sets; optional bans) and validated at construction. Check never returns an error: any failure logs at WARN, counts on errors_total, and fails open.

Validation

• go test ./ratelimit/ - 92%+ coverage, race-clean
• golangci-lint - 0 issues
• Cross-SDK parity pinned by the labkit-spec conformance harness: all rate-limit scenarios green in lockstep with the Ruby SDK (companion MR on labkit-spec)

Related

Related to gitlab-com/gl-infra/production-engineering#29829 (closed)