GraphQL: Add user identification and advanced rate limiting

Create a design (perhaps a different service) for user auth and rate limiting

---

Migrated from T4301 (view on Phabricator)

marked this issue as related to #4083

added GraphQL API priority:Low labels

removed priority:Low label

added priority:Wishlist label

added activity::Design label

changed the description

changed milestone to %GraphQL API

changed time estimate to 1w