Add a rate limiter, use it to rate limit docker pulls.

I'd like to actually try to run the container if the pull fails.  We don't do this now, it requires a richer error type, but consider it a TODO, so blocking for the pull to succeed will break that.