Ratelimits: OAuth should take precedence.

The CDN exemption should not take precedence over OAuth since OAuth may
be coming through a CDN but will always be configured to bypass CDN
caching.

The non-API exemption moves down as well for consistency though it will
have no direct effect here as all OAuth requests should be API.
Ratelimits: add strict enforcement mode.

For some app pools that are selected based on the incoming request
source, such as whoalane, we may want to apply the ratelimit to ALL
kinds of requests to ensure that resources are being used fairly.  This
adds a strict enforcement mode which can be enabled in the config. Oauth
will continue to be enforced per-client ID but all other requests will
get the sitewide ratelimit.