feat: Rate limit subnet admin updates

[dsarlis]

This PR implements a rate limit on the number of subnet admin updates that can happen per subnet on a daily basis. The limit is on a subnet level to avoid having a situation where updates in one rented subnet affect another.

However, if needed a global limit can be added on top of the current one with relative ease as the rate limiter library allows for such compositions. This is left for future as for now the per subnet one should provide a good enough safety net.

[github-actions]

This pull request changes code owned by the Governance team. Therefore, make sure that
you have considered the following (for Governance-owned code):

1. Update unreleased_changelog.md (if there are behavior changes, even if they are
   non-breaking).

2. Are there BREAKING changes?

3. Is a data migration needed?

4. Security review?

How to Satisfy This Automatic Review

1. Go to the bottom of the pull request page.

2. Look for where it says this bot is requesting changes.

3. Click the three dots to the right.

4. Select "Dismiss review".

5. In the text entry box, respond to each of the numbered items in the previous
   section, declare one of the following:

• Done.

• $REASON_WHY_NO_NEED. E.g. for unreleased_changelog.md, "No
  canister behavior changes.", or for item 2, "Existing APIs
  behave as before.".

Brief Guide to "Externally Visible" Changes

"Externally visible behavior change" is very often due to some NEW canister API.

Changes to EXISTING APIs are more likely to be "breaking".

If these changes are breaking, make sure that clients know how to migrate, how to
maintain their continuity of operations.

If your changes are behind a feature flag, then, do NOT add entrie(s) to
unreleased_changelog.md in this PR! But rather, add entrie(s) later, in the PR
that enables these changes in production.

Reference(s)

For a more comprehensive checklist, see here.

GOVERNANCE_CHECKLIST_REMINDER_DEDUP

[dsarlis]

1. Updated unreleased_changelog.md.
2. The change is backwards compatible as it adds one more case where things fail but nothing changes on the interface level.
3. No data migration needed.
4. Security review is up to you.

[github-actions]

Run on a20d18a URL: https://github.com/dfinity/ic/actions/runs/22909355484

[github-actions]

Run on 5f29b08 URL: https://github.com/dfinity/ic/actions/runs/22913601593