controllers: refactor rate limits.

Refactor controllers so that endpoint rate limits are declared locally,
with the endpoint, instead of globally, in a single method in ApplicationController.

This way an endpoint's rate limit is declared in the same file as the
endpoint itself.

This is so we can add fine-grained rate limits for certain GET requests.
Before rate limits were only for non-GET requests.

app/controllers/emails_controller.rb

@@ -2,6 +2,8 @@ class EmailsController < ApplicationController
   before_action :requires_reauthentication, only: [:edit, :update]
   respond_to :html, :xml, :json
 
+  rate_limit :update, rate: 1.0/1.minute, burst: 10
+
   def index
     @email_addresses = authorize EmailAddress.visible(CurrentUser.user).paginated_search(params, count_pages: true)
     @email_addresses = @email_addresses.includes(:user)