Add a usernameAvailable GraphQL query for anonymous lookups

Exposes a new query telling whether a given username is available for
registration, and if not, why: already taken, or rejected by the
registration policy. A username reserved on the homeserver side is
deliberately reported as taken, mirroring the ambiguity of the
registration form, which doesn't tell the two apart either.

Because this effectively is a username-existence oracle, the query is
rate-limited per requester, configurable through the new
`rate_limiting.username_availability` option.

docs/reference/configuration.md

@@ -648,6 +648,14 @@ rate_limiting:
   device_code_link:
     burst: 10
     per_second: 0.016666
+
+  # Limits how many `usernameAvailable` GraphQL queries are allowed,
+  # based on source address.
+  # This query is an availability oracle usable during registration, so this
+  # limit protects against username enumeration.
+  username_availability:
+    burst: 5
+    per_second: 1.0
 ```
 
 ## `telemetry`