Add a rate limiter, use it to rate limit docker pulls.

Another option would be to wait until the QPS limit allows us to pull.  Having a queue of pending pulls might be tricky.

With things as they are, will this cause the outer code to go into a loop trying to pull and spew to the log?  (Looks like we sync every 10s by default so I guess that isn't too bad.)  Might want to have more debugging info here about which container, the name of the image, etc.

Also, there are places where we don't check for error when pulling.  I'm looking at `createNetworkContainer` in `kubelet.go`.  I wonder how they'll react to this.  We might see errors where we didn't see them before.