fix(ratelimit): prune expired endpoint identities

[eshaanag]

Summary

Closes #452

This PR fixes the unbounded growth in EndpointRateLimiter.history when many different client identities make requests and then age out of the sliding window.

What changed

• Added interval-bounded cleanup for expired identity buckets.
• Kept cleanup under the existing limiter lock to avoid concurrent mutation issues.
• Reset the cleanup timestamp when limiter state is reset.
• Added unit tests for expired identity pruning and for ensuring cleanup does not scan on every request.

Validation

• PYTHONPATH=/tmp/secuscan_test_stubs venv_tests/bin/python -c 'import os, pytest; code = pytest.main(["testing/backend/unit/test_endpoint_rate_limiter.py", "-q", "-k", "prunes_expired_identity_buckets or cleanup_is_interval_bounded or sliding_window_limiting_logic or sliding_window_reset"]); os._exit(code)'
• venv_tests/bin/ruff check backend testing/backend
• git diff --check

Note: the local full backend pytest run was attempted, but this machine cannot install the real xhtml2pdf dependency because its pycairo build needs system Cairo development headers and sudo is not available. The focused limiter tests and Ruff pass locally; CI should run the normal dependency path.

Could you please add the appropriate GSSoC label/level for this contribution if it looks good?