Add a rate limiter, use it to rate limit docker pulls.

This is really just to prevent us from DDOS-ing Docker.  (there were complaints yesterday).

We should also have an explicit "back off in case of image pull failures" component, but that is not this one.