Draft: feat: rate limiting

Closes #4

Supersedes !693 (closed)

TODO:

• Global rate limiter (in addition to the per-target one)
• Allow method of IP address detection to be configurable (not strictly related to rate-limiting, since the list devices endpoint will also use it in the future)
• Decide on a configuration format
• Potentially split media fetch (our server getting content from another server) and download (our server serving the media to a client/server)
• Decide on a default configuration
• Separately rate-limit authenticated requests made with invalid/unknown tokens
• Documentation

---

• I agree to release my code and all other changes of this MR under the Apache-2.0 license