benchmarking: pace boomer to a target rate and add the resumepaused user class - #2350

A capacity run holds each request rate for a step and reads the cost at
that rate. Stepping users does not hold a rate: a closed-loop user sends
its next request when the last one returns, so when the server slows the
offered load drops with it.

dynconfig gains target_rps, the requests per second a whole boomer worker
paces to, for user classes that pace themselves; 0 means unpaced and a
negative value is rejected. Like the other fields, the master can change
it while the run continues. locust gains --target-rps to set it, and a
--ladder step can end in @target_rps, e.g. 200:3m@4000, to change it as
the step starts. boomer reads a rate-only change at its next poll of the
master's config.

resumepaused drives ate-api-server's cold resume path at a set rate.
Each user owns one actor. On its first iteration the user creates the
actor from the glutton template and makes it cold with a resume and a
pause; every later iteration resumes the actor and pauses it again.
Boomer gives a task no user identity, so the actor is keyed by the
user's goroutine ID, as in the glutton classes. The warm-up is not paced
and is recorded under its own names, in the step that added the user. It
adds load only while users join at the spawn rate, a stretch of each
step that is trimmed anyway. An actor that fails to warm is deleted and
the user tries again on its next iteration.

Only the resume is paced, to dynconfig's target_rps, through one limiter
the users share with a burst of 1, so resumes arrive evenly rather than
in a burst at the start of each second. The target is therefore cold
resumes per second. The pauses follow at the same rate, so a capacity
the class finds is one of resume and pause cycles.

A resume that finds its actor running fails the sample, as no cold
resume happened. A failed cycle pauses the actor again so it is cold for
the next one; that pause is recorded as PauseActorRecovery, apart from
the measured pauses, and counts as a success when it finds the actor
already paused. If the atespace cannot be ensured, the worker exits at
startup. Shutdown waits for the cycles and setups in flight and deletes
every actor. They get half of its time budget; any still running then
are canceled, so a hung RPC cannot leave the deletes no time. Once
shutdown begins, samples go to Prometheus only: boomer may have stopped
draining its stats channel, and a send to it would block once the
buffer fills.

resumepaused sends the actors themselves no requests, so it runs on the
fake data plane, where it measures what a cold resume costs
ate-api-server and Postgres without the router or the restore in the
way. benchmarking/README.md documents its knobs and metrics.