Add rate limit conf to user directory endpoint

[MatMaul]

Pull Request Checklist

• Pull request is based on the develop branch
• Pull request includes a changelog file. The entry should:
  • Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
  • Use markdown where necessary, mostly for code blocks.
  • End with either a period (.) or an exclamation mark (!).
  • Start with a capital letter.
  • Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
• Code style is correct (run the linters)

[MadLittleMods]

Seems reasonable

[MadLittleMods]

What's spawning this change?

[MadLittleMods]

Any reasoning behind these values?

[MatMaul]

The per_second value should be low enough so that an user can't scrape the user directory too quickly, and the burst is big-ish because you may need to get the next page of results several times, and you may make spelling mistakes to correct.

We may want to put the burst even higher actually, since invites are often issued by batches so an user may want to search for several users in a row.

I could bump it to 200 ?

[MadLittleMods]

We're going from no rate limit to rate limit so any value is fine to start with (bump it to 200). These are the kind of thoughts I am expecting though 👍

[MadLittleMods]

Do we need to wrap this to return nice errors?

I see we do it here for example:

synapse/synapse/rest/client/presence.py

Lines 95 to 103 in f4320b5

	try:
	await self._presence_per_user_limiter.ratelimit(requester)
	except LimitExceededError as e:
	logger.debug("User presence ratelimit exceeded; ignoring it.")
	return 429, {
	"errcode": Codes.LIMIT_EXCEEDED,
	"error": "Too many requests",
	"retry_after_ms": e.retry_after_ms,
	}

[MadLittleMods]

LimitExceededError is already a SynapseError with 429 so it's probably fine without it. Just calling this out to make sure we've tried this.

[MatMaul]

So we would gain mainly the log line. I don't think it's that useful since we can also see the 429 in the request log line, and 429 is pretty well defined.