Add a rate limiter, use it to rate limit docker pulls.

Actually the more I think about it the more I think you're going to usually just spend all of the QPS budget on calls that always fail fast, starving legit calls. I think the management system needs to slice up the QPS budget and explicitly not starve other pods.

Basically I don't think you can do this while hiding the QPS budget behind the docker puller interface.