Add API rate limiting

[sbs2001]

Deploying without any guards against API spam, is a bad idea. Especially since we need to do quite a work and API payload is big.

[Hritik14]

The restframework comes with the throttling feature. If we could decide on the default limits, I'd love to open a PR for the same.

[pombredanne]

Using the DRF AnonRateThrottle should be good enough for a start

[pombredanne]

At this stage we do not have anythin beyond basic auth

We should enable the "classic" API key system for DRF API access.

For now we barely enabled "django.contrib.auth", and "rest_framework.authtoken" in the settings https://github.com/nexB/vulnerablecode/blob/479111359070cc09010bde343e210306c4b14e40/vulnerablecode/settings.py ...

But we should emulate what is done in ScanCode.io ... see aboutcode-org/scancode.io#368 and aboutcode-org/scancode.io#359

[pombredanne]

For now, I think we will not need rate limiting once we implement auth... that's a refinement for later

[TG1999]

Added authentication here #848

[pombredanne]

As a first step when we make the public instance public I suggest this:

• no auth for the UI access
• auth for API access with an API key, that can be requested simply by email for a start.

We need to add link/content in the UI to explain how to request an API key.