Implement per-identity tunnel rate limits - #7

Implement a token bucket based rate limiter on a per-identity basis.

The rate limiter follows the following rules:

• Each identity has an individually-configurable rate limit
• Each identity has only one rate limit for the whole identity, not a rate limit set for each destination
• All connections made by that identity count towards the rate limit
• Both directions of the connection count towards the limit

Configuration is stored in a new identity_metadata database table.

When a connection is opened, either a handle to an existing token bucket for the identity is created, or a new token bucket is initialised if the identity has a configured rate limit. Buckets are protected by an individual mutex, so proxy workers are only contending with other workers servicing the same identity, not all workers - we only have to grab a global mutex when a new connection is opened.

In the proxy, we replace the existing use of tokio's copy_bidirectional() with a simple (probably less than optimally performant) rate limit aware copy routine that drains tokens from the bucket as required.