Add a rate limiter, use it to rate limit docker pulls.

I think we are most of the time going to want to pass in < 1 QPS