Security: Add flood control to public write endpoints

Problem/Motivation

Endpoints that create content or increment counters (ReviewAddResource, NodeArticleLikeAddResource, NodeVideoViewAddResource, form submissions) can be called repeatedly by anonymous clients. There is no rate limiting, so counters can be inflated and the site spammed.

Proposed resolution

• Inject the core flood service and register an event per write endpoint.
• Make thresholds and windows configurable, with per-IP and per-user limits.
• Return 429 with a Retry-After header when the limit is exceeded.

Remaining tasks

Implement flood checks in MyrestResourceBase and expose the settings.

User interface changes

New rate-limit settings section.

API changes

Clients may receive 429 responses.