Replace the endpoint-specific rate limit for CreateAuthenticateChallenge with a custom rate limiter for unauthenticated requests

[espadolini]

This PR removes the endpoint-specific rate limit for /proto.AuthService/CreateAuthenticateChallenge and replaces it with a custom rate limit that only triggers when the request is understood to be an "unauthenticated" one - meaning that it's a CreateAuthenticateChallenge request with a ContextUser payload rather than being a request with username/password, token password recovery or passwordless auth.

Fixes #63549

Changelog: API rate limiting for authenticated per-session MFA requests now follows the regular API rate limits, making the limit unlikely to be hit during parallel SSH operations

Manual Test Plan

Test Environment

TBD

Test Cases

• A burst of SSH requests won't result in "rate limit exceeded" errors from the MFA attempt
• Logins are still rate limited at 20 per minute with a burst of 40