Rate-limit `/kbs/v0/auth` and add timeouts to remote key fetches

[rodneyosodo]

The /kbs/v0/auth endpoint is unauthenticated and currently has no throttling. It's not free to service (it generates a challenge), so a scripted client could hammer it and tie up server resources. Since auth is the entry point for every attestation flow, it'd be nice to throttle it per client IP.

Separately, when KBS verifies attestation tokens using remote JWKS/PEM keys, the requests to those URLs (and the remote attestation call) have no HTTP timeout. An unreachable or unresponsive endpoint can hang the request for a long time.

Proposed:

• Add a configurable per-IP token-bucket rate limit on /kbs/v0/auth, returning HTTP 429 when exceeded (set to 0 to disable).
• Add a timeout to outbound HTTP requests for JWKS/PEM fetches and the remote attestation call.

[fitzthum]

Seems fine to add, although we have never had any issues with the second point. We are probably only reaching out well-known or admin-controlled services. Check if the create we're using already has some timeout behavior built-in as well.

Arguably the first point could be handled by a different component.