Rate limiting for createCard mutation

[seluianova]

Is your feature request related to a problem? Please describe. Follow up to https://github.com/digitalfabrik/entitlementcard/issues/1421

Since this endpoint is not protected, it should be ensured that IPs with too many requests should be blocked, especially because the argon2id calculation is expensive.

Describe the solution you'd like Currently it's not clear how we can implement that. Javalin allows to add rate limiting for the entire graphql endpoint. This can be an option, but we need to decide which limit is right for us?

OR

We could create some custom solution, but not sure if makes sense (?)

Describe alternatives you've considered Maybe there is a possibility to implement limiting at the infrastructure level?

Additional context Add any other context or screenshots about the feature request here.