Implement rate limiting for OIDC Login

[JaredM2028]

As a system administrator, I want POST /auth/client-select to be rate limited by IP address, so that an attacker cannot enumerate valid usernames or abuse OIDC discovery at scale.

See app/controllers/oidc_login_controller.rb:25
expertiza#335 (comment)

[johnmweisz]

A few thoughts on this one:

• I don't think we need to set the cache store, it should default to whatever rails is set to use even if guidlines suggest an isolated store, I just want to avoid infra decisions that are trivial for them to make later
• target client_select endpoint, the others don't really do anything special
• use https://github.com/rack/rack-attack per teaching staff