Add API request rate limiting

[dosco]

What would you like to be added:

Add support to configure either a local or centralized rate limiting for the query endpoint. Rate limits should be at the IP, User ID and maybe at a higher global level. This change will require new config options and mostly be limited to the serv package.

Possible options
https://godoc.org/golang.org/x/time/rate
https://github.com/uber-go/ratelimit

Why is this needed:

APIs need rate limiting to prevent a single client from overloading the DB and help protect against any sort of distributed resource consumption attack.

[dosco]

Thanks @kpbird for such a great feature.