Add a rate limiter, use it to rate limit docker pulls.

This stuff can get a little subtle.  It might do to have a comment describing the approach here.  I'd also consider renaming this to NewSimpleRateLimiter or NewSimpleTokenBucketRateLimiter.

Something like:
```
NewTokenBucketRateLimiter creates simple leaky token bucket rate limiter that will refill based on the `qps` parameter and with a cap of `burst` tokens.  It is implemented as a set of go routines and channels such that it is continually running in the background.  It is probably not appropriate for very high values of `qps`.
```