feat: Add honeypot to rate-limit device

[speeddragon]

Adds optional path-based IP blocking to dev_rate_limit.

When a request touches a configured sensitive path, the caller’s IP is blocked in the rate limiter’s process-local
state. Subsequent requests from that IP receive HTTP 429 until the block expires.

The feature is disabled by default and can be enabled through the on/request handler:

  <<"request">> => #{
      <<"device">> => <<"rate-limit@1.0">>,
      <<"block-paths">> => [
          <<"/src/.git/config">>,
          <<".env">>,
          <<"/api/.git/config">>
      ],
      <<"retry-after">> => 86400
  }

retry-after configures the blocking period in seconds and defaults to 24 hours. Responses include the remaining
blocking duration in the retry-after header.

Configured and requested paths are normalized before exact matching, including query-string removal and leading-slash
normalization.

Testing

• Added coverage for triggering, enforcing, and expiring an IP block.
• Added coverage confirming the feature remains disabled without block-paths.
• Focused dev_rate_limit tests pass.

TODO

• Run full test.