implement a ratelimiter for objects

the existing ratelimit middleware works on a per-container level,
and causes the proxy server to sleep to force clients to slow down. it
almost never returns a 498 response.

This is something different: it's based on the assumption you already
informed your user about a rate limit on your objects.
You then limit how many times
each object (matching a certain string) can be accessed in a certain time,
The measurements are per-object and expire when no new requests have
been seen in the specified time.  Once an object is about to be
requested too often*, swift returns http 498 'rate limit reached',
instead of gently slowing down.

You can configure multiple limitations and specify a string
which must be contained within the path (including querystring) for
the setting to apply.  It falls back to the match-less version, if
specified

Configuration examples:
> 10 reqs, TTL 3600s
object_ratelimit = 10:3600
> same, but only for req paths matching 'temp_url_sig'
object_ratelimit_temp_url_sig = 10:3600

[*] Note that this design is a little racey and causes the actual
amount of allowed requests to be a little higher,
Note also that the counters are maintained in memcache and are subject
to purging or loss on daemon restart.
This is usually all OK if you just want to block abusers (it is for us)
and this keeps the code/design simple and efficient.

Change-Id: I36a8a59ad3199c0622f10d67613c4fc4d6eea14d