fix: rate limit exemptions - #174

Changes

• override for OncePerRequestFilter
• endpoint exemptions are defined under security.rate-limit.exempt-paths= (endpoints separated by comments: /api/jokes,/api/grades/)

Demo

Currently, the limit for 1 active user is 100 requests/min, so for a default (protected) endpoint:

for i in {1..110}; do
  curl -s -o /dev/null -w "$i: %{http_code}\n" http://localhost:8585/api/grades/health
done

1: 401
2: 401
3: 401
4: 401
5: 401
.
.
.
99: 401
100: 401
101: 401
102: 401
103: 429
104: 429

For an exemption added to /api/jokes:

for i in {1..110}; do
  curl -s -o /dev/null -w "$i: %{http_code}\n" http://localhost:8585/api/jokes
done

1: 401
2: 401
3: 401
4: 401
5: 401
.
.
.
99: 401
100: 401
101: 401
102: 401
103: 401
104: 401

Since I'm not logged in, I'm hitting 401s, but that shouldn't matter because it doesn't serve me a 429: too many requests when I request /api/jokes more than 100 times per minute.