Per-route rate limiting

[Southclaws]

Basic across-the-board rate limiting is now in, but we definitely need some route-level rate limits. This can be accomplished by updating rbacgen (and probably renaming) to extract OpenAPI extension properties and using that to apply rate limits.

  /threads:
    post:
      x-storyden-ratelimit: 1000
      operationId: ThreadCreate
...

And in the codegen:

    for _, path := range docModel.Model.Paths.PathItems.FromOldest() {
        for _, op := range path.GetOperations().FromOldest() {
            ops = append(ops, Operation{
                Name: op.OperationId,
            })

            rateLimit, ok := op.Extensions.Get("x-storyden-ratelimit")
            // generate route middleware with this rate limit
        }
    }

I'm still not set on an exact rate limit algo so the meaning of the underlying value will be dependent on that.

Regarding rbacgen: it's mostly likely becoming a generic codegen extension for the Storyden spec, so it would make sense to rename this to reflect that.

Given that we can use x- properties for specifying properties on each route, it makes sense to bin the existing RBAC interface mapping and instead declare the permissions actually on the routes.