Add a rate limiter, use it to rate limit docker pulls.

I think you can make this file half as long if you use a buffered channel (of length "burst") instead of explicitly adding to a bucket. CanAccept then just attempts a read...