Consider moving traffic shaping plugins earlier in the request lifecycle

[xuorig]

Currently timeouts and rate limits are applied as a tower service around the supergraph service. There is a lot happening between receiving a request over the wire and the beginning of the supergraph service. (Parsing, PQ, etc).

A benefit of having those at the supergraph service is that more information is available (operation_name or pq_id for example), which can be useful for more dynamic traffic shaping. However, a bare-bones, sane default timeout/limits is still important, potentially as early as axum.

Let me know if you have any thoughts on this.