Can you explain how API gateway rate limiting works in plain English for someone trying to understand modern cloud infrastructure?