Add a rate limiter, use it to rate limit docker pulls.

I don't see a TODO?  @dchen1107 because we were talking about error-handling around pulls yesterday - I think we could spend a bit of time in this space to make it safer, not necessary as part of this PR