Support rate limit allow lists

[dschom]

Because

• We want the ability to skip customs checks for certain emails, ips, or uids.
• This was supported in the previous version of customs, and useful for development or smoke testing.

This pull request

• Adds ability to configure and ignore certain ips, email, uids
• Wires this up in auth-server

Issue that this pull request solves

Closes: FXA-11663

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Any other information that is important to this pull request.

[chenba]

This can cause a cardinality issue, depending on the configuration and environment where this is used. E.g. if the email pattern is 'restmail'. Do you think we'd want to know the specific ip/email/uid skipped?

[dschom]

We are not passing in the IP, email or uid values themselves. Let's say all three opts were provided. The values passed in would be, ['email','ip','uid']. I don't think this would cause a cardinality problem.

[chenba]

Oh I totally misread that. 👍

[vbudhram]

I always feel a bit nervous using regex in these types of filters. Mostly because of the chance to mess them up and allow unintended things. Should we do this based on specific domains or explict emails?

[dschom]

I think this is how it worked previously. I do understand this concern though... There are some cases where it makes sense to filter by domain, and not explicitly by email address. Let me file a polish PR where we can do this by ignoreEmails and ignoreEmailDomains. For now, or rules would be very regexes would be similar to the examples above, so I'm not too worried about it.

Also, just a side note, but the more I think about how these filters work, I think using the ip filters is the way to go.