Protect the Transaction Manager against misconfigured clients using rate limits

We have seen cases where misconfigured clients can overwhelm the system by making expensive requests (like invalidating transactions). By the time admins figure out there is a misconfigured client and take corrective action, thousands of invalid transactions can be created in a very short period of time. It would be useful to have a way to limit the number of invalid transactions that a client can create in given time.

I'll send out a design document for this soon.