When using PAT, rate-limiting should key on the token, not IP

[knolleary]

Current Behavior

Currently, rate-limit is keyed based on request.sid (a session id), or falls back to src ip.

When accessing the API with a personal access token, request.sid isn't set, so the rate-limiting applies to the IP.

We should be keying on the token.

1. when using a PAT, set request.pat to a hash(?) of the token. Maybe that's unnecessary and could just be the token
2. in the rate-limit keyGenerator function, fall back to that after sid, but before ip.

Expected Behavior

No response

Steps To Reproduce

No response

Environment

• FlowFuse version:
• Node.js version:
• npm version:
• Platform/OS:
• Browser:

Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate