Add a rate limiter, use it to rate limit docker pulls.

By making this a hidden detail of the puller, you're sort of making an assumption that the caller will retry on a long-enough timescale to eventually pass.  we already have a problem where we can't tell if a pull failed because of network error, because of server error, or because the image doesn't exist.   We will have to do better on error reporting eventually.  I guess we can revisit the error type later, and maybe pass up more info in a specific type for this case.