Fix/ratelimit stale eviction

[ademboukabes]

Problem

The ratelimit package maintains a byKey map that creates a new *rate.Limiter for every distinct source name. Because these limiters are never removed, the map grows indefinitely. This presents a vulnerability where an attacker could exhaust process memory over time simply by sending requests with many randomized source names.

Solution

This PR updates the token bucket implementation to track its last access time and introduces an EvictStale method.

• Wraps the *rate.Limiter in an internal bucket struct that records lastSeen.
• Adds EvictStale(olderThan time.Time) int to allow the caller to periodically prune buckets that haven't been accessed recently.
• The cutoff time is passed explicitly rather than relying on an internal clock, maintaining pure logic and enabling fully deterministic testing without time.Sleep.

Verification

• Added deterministic tests for EvictStale verifying removal of stale buckets and retention of active ones.
• go vet and go test -race ./... pass successfully.