[Backend] Add Rate Limiting to `/scan` and `/scan-url` Endpoints

[arpit2006]

Description

The /scan and /scan-url endpoints execute resource-intensive operations, including running external security scanners (Semgrep, OSV-Scanner, and Gitleaks) and writing scan results to disk. Currently, there is no rate limiting, allowing a single client to overwhelm the server by sending repeated scan requests.

Implement IP-based rate limiting using slowapi to protect the service from abuse and accidental resource exhaustion.

Acceptance Criteria

• Add slowapi as a backend dependency.
• Apply a default limit of 5 scan requests per minute per IP.
• Make the limit configurable via the SCAN_RATE_LIMIT environment variable.
• Return HTTP 429 Too Many Requests with a Retry-After header when the limit is exceeded.
• Add unit/integration tests verifying the 6th request within the limit window returns 429.
• Ensure all existing tests continue to pass.
• Document SCAN_RATE_LIMIT in a new Configuration section of README.md.

Expected Impact

• Prevents abuse of expensive scan endpoints.
• Improves server stability under heavy traffic.
• Makes rate limits configurable for different deployment environments.

Difficulty: Easy–Medium

[github-actions]

👋 Welcome @arpit2006!

Thank you for opening an issue and contributing to Patchpilot. 🚀

Next Steps

• Please ensure you've provided all the required details.
• A maintainer will review your issue shortly.
• Feel free to ask questions if anything is unclear.

⚡ Want faster assignment and quicker responses?

Join our Discord community:

🔗 https://discord.gg/FcXuyw2Rs

We actively discuss issues, features, roadmap updates, and contributor support there.

Happy Contributing! 🎉