feat(git): add per-client clone rate limiting

[worstell]

Add a per-client-IP concurrent clone limiter to prevent a single client from monopolizing all clone capacity. When a client exceeds the configured limit, requests are rejected with 429 Too Many Requests and a Retry-After header.

Changes

• ratelimit.go: ClientCloneTracker tracks in-flight clone count per client IP. TryAcquire returns a release function on success, or false when the limit is reached. Thread-safe, cleans up entries when all slots are released.
• Config.MaxClonesPerClient: HCL-configurable via max-clones-per-client in the git strategy block. Defaults to 0 (disabled).
• submitClone: Extracted from handleRequest to encapsulate clone submission with rate limiting. Returns 429 when the client exceeds the limit; otherwise submits the clone job and serves via spool/upstream.
• cachew.git.clone_rejections_total: New OTel counter with client attribute for observability.

How it works

1. When a git request arrives for a repo in StateEmpty, submitClone checks the per-client tracker before submitting the clone job.
2. If the client has fewer than max-clones-per-client in-flight clones, a slot is acquired and the clone job is submitted. The slot is released when the clone completes.
3. If the client is at the limit, the request is rejected with 429 and a Retry-After: 30 header. No clone is submitted.
4. When disabled (max-clones-per-client = 0, the default), behavior is unchanged.

Testing

• Unit tests for acquire/release, idempotent release, concurrent contention, entry cleanup, and IP extraction.
• All existing tests pass.