Move flood control from core to API layer

This means that flood control can be disabled depending on the nature of the request (i.e. when authenticated using a master API key). The particular use case for this is to allow using the API to migrate data from an old forum.

src/Http/Middleware/AuthenticateWithHeader.php

@@ -40,6 +40,8 @@ class AuthenticateWithHeader implements MiddlewareInterface
             if (isset($parts[1])) {
                 if (ApiKey::find($id)) {
                     $actor = $this->getUser($parts[1]);
+
+                    $request = $request->withAttribute('bypassFloodgate', true);
                 }
             } elseif ($token = AccessToken::find($id)) {
                 $token->touch();