The stashing feature should be rate limited per-user or per-ip. I guess we could use User::pingLimiter (probably extract the functionality into a MW service object).

Implementation idea:

• add a checkRateLimit( $action ) method to the Authority interface. Note that $action is similar to but not quite the same as $action on probablyCan() and friends.
• UserAuthority can implement checkRateLimit by calling User::pingLimiter for now. Eventually, this logic should be factored into a service object.
• PageHTMLHandler::postValidationSetup should call getAuthority and pass the authority to the ParsoidHTMLHelper.
• ParsoidHTMLHelper::getHTML should call checkRateLimit( 'stash-base-html' ) on the authroity object.