Add API rate limiting

[sbs2001]

Deploying without any guards against API spam, is a bad idea. Especially since we need to do quite a work and API payload is big.

[Hritik14]

The restframework comes with the throttling feature. If we could decide on the default limits, I'd love to open a PR for the same.

[pombredanne]

Using the DRF AnonRateThrottle should be good enough for a start

[pombredanne]

At this stage we do not have anythin beyond basic auth

We should enable the "classic" API key system for DRF API access.

For now we barely enabled "django.contrib.auth", and "rest_framework.authtoken" in the settings https://github.com/nexB/vulnerablecode/blob/479111359070cc09010bde343e210306c4b14e40/vulnerablecode/settings.py ...

But we should emulate what is done in ScanCode.io ... see https://github.com/nexB/scancode.io/pull/368 and https://github.com/nexB/scancode.io/issues/359

[pombredanne]

For now, I think we will not need rate limiting once we implement auth... that's a refinement for later

[TG1999]

Added authentication here https://github.com/nexB/vulnerablecode/pull/848

[pombredanne]

As a first step when we make the public instance public I suggest this:

• no auth for the UI access
• auth for API access with an API key, that can be requested simply by email for a start.

We need to add link/content in the UI to explain how to request an API key.