Add /-/metrics as a health endpoint to RackAttack

The metrics endpoint is the endpoint hit by a prometheus-scrape. It
should not be rate-limited.

lib/gitlab/rack_attack/request.rb

@@ -24,7 +24,7 @@ module Gitlab
       end
 
       def health_check_request?
-        path =~ %r{^/-/(health|liveness|readiness)}
+        path =~ %r{^/-/(health|liveness|readiness|metrics)}
       end
 
       def product_analytics_collector_request?

spec/requests/rack_attack_global_spec.rb

@@ -106,7 +106,7 @@ RSpec.describe 'Rack Attack global throttles' do
         let(:request_jobs_url) { '/api/v4/jobs/request' }
         let(:runner) { create(:ci_runner) }
 
-        it 'does not cont as unauthenticated' do
+        it 'does not count as unauthenticated' do
           (1 + requests_per_period).times do
             post request_jobs_url, params: { token: runner.token }
             expect(response).to have_gitlab_http_status(:no_content)
@@ -114,6 +114,17 @@ RSpec.describe 'Rack Attack global throttles' do
         end
       end
 
+      context 'when the request is to a health endpoint' do
+        let(:health_endpoint) { '/-/metrics' }
+
+        it 'does not throttle the requests' do
+          (1 + requests_per_period).times do
+            get health_endpoint
+            expect(response).to have_gitlab_http_status(:ok)
+          end
+        end
+      end
+
       it 'logs RackAttack info into structured logs' do
         requests_per_period.times do
           get url_that_does_not_require_authentication