Require API keys for clients that hit our APIs over a certain rate limit

I'm strongly considering following github's example and having API access keys be required for Open Library APIs above some threshold of usage

* **Greater Visibility:** see list of API callers by account / volume
* **Improve Contactability:** Don't rely on useragent / headers being added in; make it required.
* **Easier administration:** Instead of blocking an IP, simply (temporarily) block the account; make it easy for patron services / those beyond engineering team to intervene
* **Promote Responsible Use:** Reduce exposure of potentially abusive behavior through more explicit contract
* **Automated Detection:** Automatically reply to high use patterns with warnings and explanations

It doesn't have to be all-or-nothing. We can phase it in and also have a lower-access mode below some threshold.

## Which APIs?

search.json, covers, books.json are 3 candidates

### Proposal & Constraints

### What is the proposed solution / implementation?

### Is there a precedent of this approach succeeding elsewhere?

### Which suggestions or requirements should be considered for how feature needs to appear or be implemented?

### Leads

### Related files

### Stakeholders

**Note:** Before [making a new branch](https://github.com/internetarchive/openlibrary/wiki/Git-Cheat-Sheet#making-changes-and-creating-a-pull-request) _or_ updating an existing one, please [ensure your branch is up to date](https://github.com/internetarchive/openlibrary/wiki/Git-Cheat-Sheet#working-on-your-branch).