Allow Configurable Rate-Limit Key Derivation in RateLimiter Middleware

## Problem Statement

The current `RateLimiter` middleware in gofr supports request limiting primarily based on **IP address** (`PerIP` flag).
While this works well for generic APIs, it is **not sufficient for authentication and identity-based use cases** such as:

- Login attempts per **email**
- OTP validation per **user ID**
- Password reset attempts per **account**
- API throttling per **API key / tenant / user**

At the moment, developers cannot easily apply rate limiting on identifiers other than IP without writing custom middleware or duplicating logic.

---

## Current Limitation

```go
RateLimiterConfig{
RequestsPerSecond: 5,
Burst: 10,
PerIP: true,
}