Security: metrics publicly exposed by default

[dokterbob]

By default, the Prometheus metrics and pprof HTTP server are listening on 0.0.0.0, which is likely to cause information leaks and/or might expose attack vectors.

As this daemon is to be run on public addresses by default, and uses randomly picked ports for the heads, this default of publicly exposing non-essential services seems a bad design from a security point of view.

In addition, it is inconsistent with the other listeners which default to 127.0.0.1 (as they should).

[alanshaw]

🙏 would you be up for submitting a PR to fix?

[dokterbob]

While I'm at it, I'll also change the port to something less common than 8888, to prevent conflicts.