Add a rate limiter, use it to rate limit docker pulls.

And I don't want to block, for the reasons Tim mentioned.  I want to retry using a local image.  I realize that the code doesn't do that right now as written, since we'll need to introduce our own error type.  It's TODO'd