Retry and retry budget

A transient blip should be retried, but blindly retrying a sustained outage multiplies the load on a backend that is already failing. httpware retries with full-jitter backoff, and a budget caps the share of traffic spent on retries.

That was one client recovering from a blip. Blind retries do the most harm at scale, when many clients hit a real outage at once.