The rate limit policy has now been changed to a middleware.
See the example from a plugin extension below:
plugin.routes['content-api'].routes.push({
method: 'GET',
path: '/auth/passwordless',
handler: 'auth.passwordless',
config: {
// policies: ['plugins::users-permissions.ratelimit'],
middlewares: ['plugin::users-permissions.rateLimit'],
prefix: '',
},
})