Add rate limiter for registration route

[TobMoeller]

This PR adds an (optional) rate limiter to the registration route to help mitigate abuse. Without throttling, bots or malicious users could potentially create millions of accounts in a short period or perform a denial-of-service attack by overwhelming the endpoint.

Testing Considerations

I haven't included automated tests for this functionality yet. If someone can offer guidance or assistance on the best approach to test this rate limiter, that would be greatly appreciated.

Documentation

The UPGRADE.md file currently includes changes to the two-factor rate limiting. I was uncertain, if this addition should be included aswell.

Rate Limiting Logic

The current logic (5 registrations per minute per IP) is debatable. I welcome discussion on whether this limit should be adjusted, made configurable, or if alternative approaches should be considered.

[taylorotwell]

This will block legitimate registrations due to IP addresses often being shared.