Add a new middleware that checks a rate limiting service and returns a 429 if the CID is over a rate limit.

This sketches out an API for the rate limiting and accounting services suggested in storacha/RFC#28

This is not ready to merge, but should probably be the starting point for this work once we all agree that this is the right shape.

introduce a KV namespace for caching token metadata - for now the "invalid" boolean is the most important thing, as that's how we decide whether a token is valid.

I thought we'd be able to serve tokened requests when in doubt, but I'm a bit worried about people generating random tokens if we go that route - sending a different random token with each request would theoretically allow them to make infinite unbilled requests.

instead I went with a pattern that will likely require us to warm the cache before a token-based request achieves hot-storage level performance - we cache auth token metadata in KV and wait for the accounting service to return it if we don't find it in the cache. Using a "Stale While Revalidate" pattern to update the cache will allow us to maintain performance and the ability to disable tokens.