Add an instance-level inflight bytes limit to the distributor

An application-level flag such as -distributor.max-inflight-bytes can protect distributors from being OOMKilled when segment writers experience slowdowns or outages.

Prior art:

• Mimir: -distributor.instance-limits.max-inflight-push-requests(-bytes), enforced at distributor.go#L1443
• Loki: -distributor.max-inflight-bytes, enforced at distributor.go#L661-L669

Should be opt-in and apply for both the regular (sync) and the async write path.