Configure per-device token-bucket rate limiters on Firecracker virtio-net (rx/tx) and virtio-block (ops and bandwidth) to cap guest I/O

Documented steps

1. Rate limiting uses a token-bucket (TokenBucket) model per device; for virtio-net you set two independent limiters rx_rate_limiter and tx_rate_limiter on the network interface, for virtio-block you set one rate_limiter containing separate 'ops' (IOPS) and 'bandwidth' (bytes/s) buckets
2. Define a bucket as {size, one_time_burst, refill_time}: size is burst capacity (bytes or ops), refill_time is the period in ms for one token, one_time_burst is an optional initial burst of tokens
3. Attach a network interface with a Tx cap: curl --unix-socket /tmp/firecracker.socket -X PUT http://localhost/network-interfaces/my_net -d '{"iface_id":"my_net","host_dev_name":"tap0","tx_rate_limiter":{"bandwidth":{"size":262144,"one_time_burst":0,"refill_time":100}},"rx_rate_limiter":{"bandwidth":{"size":262144,"one_time_burst":0,"refill_time":100}}}'
4. Attach a block drive with IOPS + bandwidth caps: curl --unix-socket /tmp/firecracker.socket -X PUT http://localhost/drives/drive1 -d '{"drive_id":"drive1","path_on_host":"/tmp/img.ext4","is_root_device":false,"rate_limiter":{"ops":{"size":100,"one_time_burst":50,"refill_time":100},"bandwidth":{"size":1048576,"one_time_burst":0,"refill_time":100}}}'
5. The same TokenBucket model applies to virtio-rng (entropy), virtio-pmem and the serial console, so those can be throttled too
6. You can update limiters on a running VM via PATCH on the specific device endpoint (net/block partial updates)