feat(rate_limit): add per-check and per-rule-evaluation counters

Description

Splits the rate limiter's Prometheus instrumentation into a per-check counter and a per-rule-evaluation counter. The existing calls_total answers two questions with one metric and does neither well: summing it by rate_limiter counts rule evaluations rather than requests, the rule="unmatched" placeholder conflates "no rule matched", "only non-terminating :log rules matched", and "a rule was skipped by the count_distinct fail-open", and a check that fails open increments nothing but errors_total — so error ratios have no shared denominator.

Related Issues

Related to gitlab-com/gl-infra/production-engineering#29519

New metric contract

Metric	Labels	Semantics
gitlab_labkit_rate_limiter_checks_total	rate_limiter, action, matched, error	New. Exactly one increment per check call, including fail-open. action = caller-facing decision (allow|block). sum by (rate_limiter) = request rate, no dedup tricks.
gitlab_labkit_rate_limiter_rule_evaluations_total	rate_limiter, rule, action, result	New. One increment per evaluated rule (matched :skip included; match-testing emits nothing). action = configured rule action; result = decided (allow|block|log|skip; an exceeded :log rule reports result="log", folding the earlier proposed exceeded label into result).
gitlab_labkit_rate_limiter_calls_total	rate_limiter, rule, action	Deprecated, emitted unchanged (assertions from before this MR pass verbatim).
gitlab_labkit_rate_limiter_errors_total	rate_limiter	Deprecated, emitted unchanged; remains the only error metric for peek, which deliberately emits no checks_total (peek must not inflate check rates).