We're building new endpoints as part of #248, and discussing this in places like https://github.com/Police-Data-Accessibility-Project/data-sources-app/issues/345

[ ] add basic rate limiting to the API for all endpoints
- our API is generally for public data access, so per-IP makes sense
- since we're using JWT, we could do per-token for logged in users
- ~100 requests per hour for data fetching
[ ] add more refined rate limiting to special case endpoints
- typeahead should be ~10 per second
- login should be ~5 per minute
[ ] messaging for exceeded rate limit
- i can help with the copy, but we need to communicate "try that more slowly!" or "try again in 1 minute" or whatever.

nice to have:

mention this in the API docs; path to complain if people think they're too strict

Most of these numbers and specifics can change

Implementation Notes

Using Flask-Limiter for this.
This is set to save limits by IP address in memory. In the far future, when the app may be running from multiple locations at once, we could switch to redis or something similar, but that seems overkill for now.
I've set the default rate limit (i.e., the rate limit for any endpoint not otherwise specified) to be 100 per hour. Obviously, we can adjust this over time.
Because callback.py is likely to come only from Github, I tried to set the rate limit to exempt using the @limiter.exempt decorator. But it wasn't working for reasons I could not figure out, and was instead limiting by the default rate limit. So I instead settled for the really stupid solution of setting the rate limit to 1 million calls per second, which works.

Testing

Testing in this case is weird, because it is a third party app.
Rather than testing that it works across every endpoint, I tested that it worked with the default rate limit when a limit isn't specified, and when the limit was explicitly specified using @limiter.limit.
In both of these tests, I also tested that the rate limiter refreshed when using a different IP address.
I additionally tried to test the @limiter.exempt decorator, but since exempt didn't work as I described above, I got rid of that test.

[x] I'm okay with adding documentation to the endpoints, but I would point out that if the rate limit is exceeded, the default error message does state what the rate limit is, so I want to double-check if you'd still like to add it to the documentation.
```
{
"http_status_code": 500,
"message": "429 Too Many Requests: 1 per 1 minute"
}
```
[x] There's an oddity in that (presumably due to the @handle_requests decorator), some methods, when reaching their rate limit, will return a 500 (Internal Error) status code rather than the 429 (Too Many Requests) status code. Not a major issue at this moment, but probably worth noting for the future.