Internal metrics: /metrics endpoint is publicly exposed by default with no auth

### What happened? I opened [grafana-root-url]/metrics in a clean browser session and could see a bunch of text that includes the names of my data sources, something which I would rather not have publicly exposed. The Grafana installation uses grafana.ini with the [metrics] part that was not modified since the original install: ``` [metrics] # Disable / Enable internal metrics ;enabled = true # Graphite Publish interval ;interval_seconds = 10 # Disable total stats (stat_totals_*) metrics to be generated ;disable_total_stats = false # The interval at which the total stats collector will update the stats. Default is 1800 seconds. ;total_stats_collector_interval_seconds = 1800 #If both are set, basic auth will be required for the metrics endpoints. ; basic_auth_username = ; basic_auth_password = ``` ### What did you expect to happen? A 404 error or a log in prompt. ### Did this work before? I only recently realized by random chance that I have been exposing this information on my Grafana install. I'm not the only one to be surprised by this. See for example this issue from Feb 2025: https://github.com/mother-of-all-self-hosting/ansible-role-grafana/issues/4 It's also been mentioned in passing in older discussions here. One example from 2024: https://github.com/grafana/grafana/issues/31356#issuecomment-2354932593 Apparently, it's a common enough misconfiguration to be now included in automated scanning tools: https://pentest-tools.com/vulnerabilities-exploits/grafana-metrics-endpoint-information-disclosure_28501 Indeed, looking at my server logs, this endpoint is regularly hit by random scanners. It's good software practice to have the default config secure by default. Unnecessary information should not be publicly exposed unless there is explicit action from the admin. I suggest changing the default for `metrics.enabled` to `false`. The default Grafana config is now over 2100 lines of text, with the relevant section currently appearing at line 1698. It's unr…