fix(security): give every public endpoint a volume ceiling (ADR-082) (#514)

These methods declare themselves public with the legacy @publicpage
ANNOTATION rather than the #[PublicPage] attribute, which is why the fleet
sweep that reported this app fully throttled did not see them: that sweep
line-anchored the attribute form and excluded docblock matches.

The annotation is not a docblock mention. It is a live declaration, proven
against the running server on two other apps in this fleet:

    openregister GraphQLController::execute   @publicpage only -> 200 anon
    opencatalogi CatalogiController::index    @publicpage only -> 200 anon

AnonRateLimit only, not BruteForceProtection: these endpoints check no
credential, and brute-force protection without a paired registerAttempt() is
the inert half of a two-half mechanism. AnonRateLimit also leaves
authenticated server-to-server traffic untouched, so no integration can be
throttled by this change.

Health endpoints get a deliberately generous 240/60 - monitoring polls them on
a short interval, and a ceiling that trips on a normal probe cadence turns the
health check into the outage it was meant to detect.

Verification: php -l clean on every changed file; the diff is purely additive
with zero lines removed; gate-82 (.github#460) goes to 0 findings on this tree.

Author: rubenvdlinde

lib/Controller/AangebodenGebruikController.php

@@ -23,6 +23,7 @@
 use OCA\SoftwareCatalog\Service\AangebodenGebruikService;
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\AnonRateLimit;
 use OCP\AppFramework\Http\JSONResponse;
 use OCP\IGroupManager;
 use OCP\IRequest;
@@ -203,6 +204,7 @@ public function getGebruiksWhereAfnemer(): JSONResponse {
 	 * @PublicPage
 	 * @spec           openspec/specs/aangeboden-gebruik-api/spec.md
 	 */
+	#[AnonRateLimit(limit: 120, period: 60)]
 	public function getKoppelingenGebruikByUuid(string $uuid): JSONResponse {
 		$this->logger->info(
 			'API: Getting koppelingen and gebruiks for specific UUID',
@@ -293,6 +295,7 @@ public function getKoppelingenGebruikByUuid(string $uuid): JSONResponse {
 	 * @PublicPage
 	 * @spec           openspec/specs/aangeboden-gebruik-api/spec.md
 	 */
+	#[AnonRateLimit(limit: 120, period: 60)]
 	public function getAllGebruiksForAmbtenaar(): JSONResponse {
 		$this->logger->info(
 			'API: Getting all gebruiks for ambtenaar (ignoring RBAC/multitenancy)',
@@ -400,6 +403,7 @@ public function getAllGebruiksForAmbtenaar(): JSONResponse {
 	 * @SuppressWarnings(PHPMD.ExcessiveMethodLength)
 	 * @spec                                          openspec/specs/aangeboden-gebruik-api/spec.md
 	 */
+	#[AnonRateLimit(limit: 120, period: 60)]
 	public function getSingleGebruikForAmbtenaar(string $gebruikId): JSONResponse {
 		$this->logger->info(
 			'API: Getting single gebruik for ambtenaar (ignoring RBAC/multitenancy)',
@@ -570,6 +574,7 @@ private function isUserInGroup(string $groupName): bool {
 	 * @PublicPage
 	 * @spec           openspec/specs/aangeboden-gebruik-api/spec.md
 	 */
+	#[AnonRateLimit(limit: 120, period: 60)]
 	public function getGebruiksWhereDeelnemers(): JSONResponse {
 		$this->logger->info(
 			'API: Getting gebruiks where active org is in deelnemers',
@@ -857,6 +862,7 @@ function ($key) {
 	 * @SuppressWarnings(PHPMD.ExcessiveMethodLength)
 	 * @spec                                          openspec/specs/aangeboden-gebruik-api/spec.md
 	 */
+	#[AnonRateLimit(limit: 120, period: 60)]
 	public function getApiDocumentation(): JSONResponse {
 		$documentation = [
 			'api_version' => '2.0.0',

lib/Controller/GebruikController.php

@@ -23,6 +23,7 @@
 use OCA\SoftwareCatalog\Service\GebruikService;
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\AnonRateLimit;
 use OCP\AppFramework\Http\JSONResponse;
 use OCP\IConfig;
 use OCP\IGroup;
@@ -92,6 +93,7 @@ public function __construct(
 	 * @spec openspec/specs/open-data-publishing/spec.md
 	 * @spec openspec/specs/vendor-visibility-rbac/spec.md#requirement-every-rbac-bypassing-gebruik-koppeling-contract-read-must-evaluate-its-deny-check-before-issuing-the-bypass-query-req-001
 	 */
+	#[AnonRateLimit(limit: 120, period: 60)]
 	public function getGebruiken(): JSONResponse {
 		// Open-data posture (open-data-publishing): gebruik is inherently
 		// organisation-scoped, so an anonymous caller receives the documented