Pre-auth Rate Limiting heuristic

[alexsnaps]

We can have a first round of rate limiting happen prior to the auth phase, when there is no need to resolve anything on the auth. root binding in none of the expressions and/or predicates within a RateLimitPolicy. I'd do that for limits coming from a RateLimitPolicy where this is true for all limits, so that limits from a single policy are always "transactional" (i.e. all counters get incremented or none is).

The proposal is to scan expressions on these policies and have the resulting Action be first in the wasm-shim's config ActionSet, when nothing from the auth root binding is read.