Make routes for different endpoints configurable (including switching them off)

[beorn7]

The dev-summit decided (almost a year ago, on 2023-11-30) that we want this.

There was some discussion if this should be only about switching on and off certain endpoints (e.g. /pprof) or do more stuff like binding different endpoints to different ports or interfaces.

/cc @SuperQ @bwplotka

One trigger was prometheus/pushgateway#520 , which has some relevant discussion. But there are regular concerns reported about certain endpoints exposed to the public internet (in particular /pprof and /metrics, but also certain APIs depending on the binary in question). While we do not plan to lockdown binaries by default (cf. dev-summit on 2024-10-24), it would be good to give users an easy way to configure what to expose where.

[sriharshabm]

As described in prometheus issues 17778, When TLS and/or Basic Authentication is enabled in Prometheus ecosystem compoents then all endpoints (including probes) must be accessed securely. Proposed solution is to have separate HTTP endpoint (without basic auth) which will support only probes(Health check as well as Readiness check). We can continue to support Probes on existing endpoints to keep backward compatibility. We can have feature flag to control creation of additional HTTP port for probe. We are ready to contribute this functionality. Pls confirm that above functionality is fine or any further changes are needed.