Add a usernameAvailable GraphQL query for anonymous lookups

Exposes a new query telling whether a given username is available for
registration, and if not, why: already taken, or rejected by the
registration policy. A username reserved on the homeserver side is
deliberately reported as taken, mirroring the ambiguity of the
registration form, which doesn't tell the two apart either.

Because this effectively is a username-existence oracle, the query is
rate-limited per requester, configurable through the new
`rate_limiting.username_availability` option.

docs/config.schema.json

@@ -2033,6 +2033,18 @@
               "$ref": "#/definitions/RateLimiterConfiguration"
             }
           ]
+        },
+        "username_availability": {
+          "description": "Controls how many `usernameAvailable` GraphQL queries are permitted\nbased on source address.\n\nThis query is an availability oracle usable during registration, so\nthis limit protects against username enumeration.",
+          "default": {
+            "burst": 5,
+            "per_second": 1.0
+          },
+          "allOf": [
+            {
+              "$ref": "#/definitions/RateLimiterConfiguration"
+            }
+          ]
         }
       }
     },

docs/reference/configuration.md

@@ -648,6 +648,14 @@ rate_limiting:
   device_code_link:
     burst: 10
     per_second: 0.016666
+
+  # Limits how many `usernameAvailable` GraphQL queries are allowed,
+  # based on source address.
+  # This query is an availability oracle usable during registration, so this
+  # limit protects against username enumeration.
+  username_availability:
+    burst: 5
+    per_second: 1.0
 ```
 
 ## `telemetry`