api_failure_abort_threshold counts rate limits as failures

Every 429 increments _api_request_failures, and at api_failure_abort_threshold (10 by default) the module is disabled for the rest of the scan.

A 417-IP scan against Shodan produced 89 rate-limit responses — normal operation for that API, not failure. A threshold meant for broken endpoints arguably should not count throttling toward it.

Issues 3 and 4 together are why the Shodan module issues its own requests.