Per-route rate limiting

[Southclaws]

Basic across-the-board rate limiting is now in, but we definitely need some route-level rate limits. This can be accomplished by updating rbacgen (and probably renaming) to extract OpenAPI extension properties and using that to apply rate limits.

  /threads:
    post:
      x-storyden-ratelimit: 1000
      operationId: ThreadCreate
...

And in the codegen:

	for _, path := range docModel.Model.Paths.PathItems.FromOldest() {
		for _, op := range path.GetOperations().FromOldest() {
			ops = append(ops, Operation{
				Name: op.OperationId,
			})

			rateLimit, ok := op.Extensions.Get("x-storyden-ratelimit")
			// generate route middleware with this rate limit
		}
	}

I'm still not set on an exact rate limit algo so the meaning of the underlying value will be dependent on that.

Regarding rbacgen: it's mostly likely becoming a generic codegen extension for the Storyden spec, so it would make sense to rename this to reflect that.

Given that we can use x- properties for specifying properties on each route, it makes sense to bin the existing RBAC interface mapping and instead declare the permissions actually on the routes.