Move metrics to its own HTTP server
Move metrics to its own HTTP server

It may be useful to restrict access to the metrics endpoint as it's
unauthenticated and thus exposes some data.

This creates a new router and HTTP listener just for metrics, defaulting
to listening on localhost:3000.

TLS can be enabled on the metrics server if enabled for the main
application - it relies on autocert being configured from the main
server so it can't be enabled independently.

jamesog/scan,jamesog/scan,jamesog/scan