executors: Executors should not be exposed publicly

[efritz]

Currently executor instances are exposed to the public internet and they expose a debug server with vars and gc endpoints that may contain information unsuitable for public consumption. (It's also able to trigger a GC run arbitrarily via these endpoints, so we should at a minimum allowlist the ingress traffic).

[github-actions]

Heads up @macraig - the "team/code-intelligence" label was applied to this issue.

[eseliger]

Maybe for now we can just expose /metrics for executors, and not the others like trigger GC and such.

[eseliger]

Or we add exporter/exporter and just expose that.