Mitigate entropy depletion

[awh]

This PR adds adaptive connection acceptance rate limiting in the form of a lazy token bucket implementation, replacing the constant 1ms sleep in use before. The bucket contains a maximum of 100 tokens, replenished at a rate of one every 100ms; this allows a burst of up to 100 connection attempts without any delay, limiting to 10 per second thereafter under sustained load. Quiescence allows the bucket to refill back to its maximum, the intended effect being that initial network formation and partition healing are not hindered at all, but a sustained denial of service will be.

Testing reveals that this does not address the reported issue entirely - even at the lower bound of 10 requests per second there may not be enough entropy gathered on a headless system to keep pace. Nevertheless, after careful investigation and research, we have concluded that of the two options available to us (the other being implementing and seeding our own CSPRNG in a similar fashion to OpenSSL) this is by far the safest. We have been convinced that the impact of such an attack is limited to slowing /dev/random readers, so we have recorded our rationale along with links to supporting expert opinion in our cryptography design document.

In closing, it is noteworthy that OpenSSH can be used to deplete entropy in exactly the same fashion, as each forked process consumes 256 bits from /dev/urandom.

Closes #1037.

[awh]

Replaces #1111.