Add a rate limiter, use it to rate limit docker pulls.

Why not just block until the QPS block is lifted?