add support of rate limit and timeout

[bnjjj]

close #946
close #1184
close #1275
related to #338

Additions to the traffic shaping plugin:

• Rate limit - If you want to rate limit requests to a subgraphs or to the router itself.
• Timeout: - Set a timeout to subgraphs and router requests.

example of configuration:

traffic_shaping:
  router: # Rules applied to requests from clients to the router
    rate_limit: # Accept a maximum of 10 requests per 5 secs. Excess requests must be rejected.
      capacity: 10
      interval: 5s
    timeout: 50sec # If a request to the router takes more than 50 secs then cancel the request (30 sec by default)
  subgraphs: # Rules applied to requests from the router to individual subgraphs
    products:
      rate_limit: # Accept a maximum of 10 requests per 5 secs. Excess requests must be rejected.
        capacity: 10
        interval: 5s
      timeout: 50sec # If a request to the subgraph 'products' takes more than 50 secs then cancel the request (30 sec by default)

Rate limit algorithm is coming from https://dev.to/satrobit/rate-limiting-using-the-sliding-window-algorithm-5fjn and https://medium.com/@intmainco/design-a-scalable-rate-limiting-algorithm-system-design-nlogn-895abba44b77

[lennyburdette]

in the changelog it says

rate_limit: # Accept a maximum of 10 requests per 5 secs from a given client. Excess requests must be rejected.

how is the client identified? is that configurable? totally fine if these are future features, i was just curious. (are we planning to eventually support something like https://docs.konghq.com/hub/kong-inc/rate-limiting/?)

[bnjjj]

@lennyburdette it's mistake it's not rate limited for a specific client. But yes if it's a needed/asked feature we could implement that kind of behavior in the future.

[prasek]

Since this is a global rate limit suggest and we'll likely want to support per client rate limiting in the future suggest using router.global_rate_limit

[Geal]

the lower (millisecond) and upper(u64::MAX milliseconds) limits of the rate limit window should be documented, no?