Add IP-based ratelimit to Stripe donation page

There's still someone trying to use the Tildes donation page to check
stolen credit cards occasionally. The new version of Checkout seems to
be blocking them all successfully, but I might as well not make it easy
on them.

tildes/tildes/lib/ratelimit.py

@@ -284,6 +284,7 @@ _RATE_LIMITED_ACTIONS = (
     RateLimitedAction("register", timedelta(hours=1), 50),
     RateLimitedAction("topic_post", timedelta(hours=1), 6, max_burst=4),
     RateLimitedAction("comment_post", timedelta(hours=1), 30, max_burst=20),
+    RateLimitedAction("donate_stripe", timedelta(hours=1), 5, by_user=False),
 )
 
 # (public) dict to be able to look up the actions by name

tildes/tildes/views/donate.py

@@ -13,6 +13,7 @@ from pyramid.view import view_config
 from webargs.pyramidparser import use_kwargs
 
 from tildes.metrics import incr_counter
+from tildes.views.decorators import rate_limit_view
 
 
 @view_config(
@@ -40,6 +41,7 @@ def get_donate_stripe(request: Request) -> dict:
         "interval": String(required=True, validate=OneOf(("onetime", "month", "year"))),
     }
 )
+@rate_limit_view("donate_stripe")
 def post_donate_stripe(
     request: Request, amount: int, currency: str, interval: str
 ) -> dict: