Reject negative rate limit costs

[carlok]

Summary

Hi Ali-Akber, first of all thank you for maintaining limits.

I noticed that negative cost values are currently not rejected before strategy evaluation. With the in-memory fixed-window and sliding-window-counter strategies, passing cost=-1 can increase the apparent remaining quota instead of consuming it.

This PR adds a small shared validation step in the sync and async RateLimiter base classes and applies it consistently before hit() / test() strategy logic.

The change deliberately preserves the existing cost=0 no-op behavior and only rejects cost < 0.

What changed

• Reject negative cost values with ValueError
• Apply validation in sync and async strategies
• Add regression tests for:
  • FixedWindowRateLimiter
  • MovingWindowRateLimiter
  • SlidingWindowCounterRateLimiter
  • sync and async variants
  • no state mutation after invalid calls

Local verification

.venv/bin/ruff check limits/strategies.py limits/aio/strategies.py tests/test_strategy.py tests/aio/test_strategy.py
.venv/bin/pytest tests/test_strategy.py -k invalid_cost_is_rejected -q
.venv/bin/pytest tests/aio/test_strategy.py -k invalid_cost_is_rejected -q
.venv/bin/pytest tests/test_strategy.py -m memory -q
.venv/bin/pytest tests/aio/test_strategy.py -m memory -q

[alisaifee]

Thanks for the contribution! You can fix most linting errors by running make lint-fix in the working directory.