estimate max load we can withstand for anonymous access to the API

We need this as a data point for T651.

Locust seems the right tool for this job, as we can use it to generate non trivial(ly cacheable) traffic patterns, including look up of existing and non existing objects.

---

Migrated from T652 (view on Phabricator)