feat(ratelimit): Add Attributes support to rate limit middleware

[nickvergessen]

Summary

• Sibling to feat(middleware): Migrate BruteForceProtection annotation to PHP Attribute and allow multiple #36928

Previously (and still supported)

	/**
	 * @UserRateThrottle(limit=20, period=200)
	 * @AnonRateThrottle(limit=10, period=100)
	 */
	public function testMethodWithAnnotation() {

New syntax

	#[UserRateLimit(limit: 20, period: 200)]
	#[AnonRateLimit(limit: 10, period: 100)]
	public function testMethodWithAttribute() {

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required feat(developer): Document ratelimit attributes documentation#10100
• Backports requested where applicable (ex: critical bugfixes)

[kesselb]

Nice 👍

[ChristophWurst]

Previously (and still supported)

I would prefer to deprecate the old system right away so we can move everyone to attribute in the next few years and drop the legacy system as soon as possible.

The same was done with 26 and @UseSession https://docs.nextcloud.com/server/latest/developer_manual/app_publishing_maintenance/app_upgrade_guide/upgrade_to_26.html#migration-from-phpdoc-annotations-to-native-php-attributes

[nickvergessen]

I would prefer to deprecate the old system right away so we can move everyone to attribute in the next few years and drop the legacy system as soon as possible.

Yeah that was my plan. The problem is I didn't find a way (without totally spaming out of control on debug) to notify devs about the deprecation. So yeah a section in the "Changes for 27" will be added for BruteForceProtection and RateLimit later on (when the doc PRs are merged and can be linked to).