Add rate limit bypass detection

[Dev9269]

Current rate limiter may be bypassed via IP rotation. Add heuristics to detect coordinated low-and-slow attacks.