API Rate limiting (backend)

[jusdino]

Depends on #392

• Update the API WAF rules to include Authorization-header-specific rate limit (Current rate limit is IP based, which limits DOS activity. Token-specific rate limits control data egress potential of compromised credentials).
• Add a WAF rule for access tokens with a lower rate limit that is specific to the SSN endpoint (limits damaging activity the holder of a revoked token, before they get locked out)
• Add REST API stage level throttling rate and burst limits
• Add lower SSN method level throttling rate and burst limits