add token bucket limiter on new stream per circuit

fix #40736 (closed)

also limits RESOLVE requests as they can also be costly to process en mass for exit nodes.

there are some TODOs left where I'm not sure what should be done exactly.
I still need to make a changes/ entry, and fill in the manpage, but the code is ready for review.