Establish NGINX-level rate limiting & client backoff

[masalim2]

NGINX offers the ideal point at which user-level rate limiting can be introduced. We may want to rate limit based on the HTTP Authorization header key (which will be unique to a user’s balsam login) rather than conventional source IP address, as that could be messed up by NAT in front of clusters.

Clients must be robust to throttling: the Python SDK already features exponential backoff and retry of timed-out connections or failed reads. We simply want to invoke the backoff when the client receives an HTTP 503 SLOW DOWN response! This keeps existing workloads robust to rate limiting: they will automatically slow down to wait their turn, rather than denying service for others.

[masalim2]

As part of this change, let's move NGINX into the docker-compose stack instead of running it separately, as proposed in #81

[masalim2]

• allow a burst of 32 requests with nodelay option; process 15 requests per second
• balsam/client robust to HTTP 503 slow downs (backoff and retry)