Add a rate limiter, use it to rate limit docker pulls.

We don't do a lot of precondition checking, and Go does not seem to endorse CHECK failing - is this a pattern we should follow elsewhere?  I have wanted to do this many times...