limits/limiters: fix panic when bucket set is full

[linsein]

fix: #857

There is a comment in the code:

maddy/internal/limits/limits.go

Lines 110 to 120 in e42741c

	// 20010 is slightly higher than the default max. recipients count in
	// endpoint/smtp.
	g.global = limiters.MultiLimit{Wrapped: globalL}
	if len(ipL) != 0 {
	g.ip = limiters.NewBucketSet(func() limiters.L {
	l := make([]limiters.L, 0, len(ipL))
	for _, ctor := range ipL {
	l = append(l, ctor())
	}
	return &limiters.MultiLimit{Wrapped: l}
	}, 1*time.Minute, 20010)

However, the maximum number of SMTP recipients is only limited per single connection. If more than 20,000 recipients are obtained through multiple connections within one minute, the bucket may also become full.

I considered whether should wait for the old limiter to be reaped. But with heavy load when the bucket is full, I think blocking the process is not a good idea.