config: Add a flag to control the /metrics and /status endpoints

It can be a security concern in some environments to expose system
capabilities even though they don't expose any PII. Add some
flags (defaulted `true` to maintain existing behaviour) to control
whether the /metrics and /status (and anything in the StatusRouter)
are exposed.

Signed-off-by: Stéphane Maniaci <stephane.maniaci@beta.gouv.fr>

public/docs/release-notes.md

@@ -2,6 +2,9 @@
 
 ## UNRELEASED
 
+### Enhancements
+- Allow disabling the /metrics and /status endpoints
+
 ### Bugfixes
 - Fix note titles with special characters producing invalid file names in user export zip file