design: add design for rate limiting

I added an example for how rate limiting should be implemented using
middleware.

Author: samthanawalla

design/design.md

@@ -470,6 +470,35 @@ server.AddReceivingMiddleware(withLogging)
 
 **Differences from mcp-go**: Version 0.26.0 of mcp-go defines 24 server hooks. Each hook consists of a field in the `Hooks` struct, a `Hooks.Add` method, and a type for the hook function. These are rarely used. The most common is `OnError`, which occurs fewer than ten times in open-source code.
 
+#### Rate Limiting
+
+Rate limiting can be configured using middleware.
+
+As an example, this code adds a per-session rate limiter using the [golang.org/x/time/rate](https://pkg.go.dev/golang.org/x/time/rate) package.
+
+```go
+// PerSessionRateLimiterMiddleware creates a middleware that applies rate limiting
+// on a per-session basis for receiving requests.
+func PerSessionRateLimiterMiddleware[S Session](limit rate.Limit, burst int) Middleware[S] {
+  var sessionLimiters sync.Map // map[*jsonrpc2.Connection]*rate.Limiter
+
+  return func(h MethodHandler[S]) MethodHandler[S] {
+    return func(ctx context.Context, session S, method string, params Params) (Result, error) {
+      conn := session.getConn()
+
+      limiter, _ := sessionLimiters.LoadOrStore(conn, rate.NewLimiter(limit, burst))
+      rateLimiter := limiter.(*rate.Limiter)
+
+      if !rateLimiter.Allow() {
+        return nil, jsonrpc2.ErrServerOverloaded
+      }
+      return h(ctx, session, method, params)
+    }
+  }
+}
+server.AddReceivingMiddleware(PerSessionRateLimiterMiddleware[*ServerSession](rate.Every(time.Second * 2), Burst: 5))
+```
+
 ### Errors
 
 With the exception of tool handler errors, protocol errors are handled transparently as Go errors: errors in server-side feature handlers are propagated as errors from calls from the `ClientSession`, and vice-versa.