Add a rate limiter, use it to rate limit docker pulls.

I don't want it to block when CanAccept fails.