add minimal rate limiting setup to protect api

[bdewilde]

changes

• adds flask-limiter dependency to package
• configures limiter extension with loose 2 calls per second default rate limit, plus generous meta limits, to prevent spamming the api
• configures a couple heavy endpoints with tighter rate limits

context

this has been on my to-do list for ages, it's a good thing to do for any api facing users

questions

• are these rate limits too restrictive? not restrictive enough?