aurweb/prometheus: Put aurweb metrics endpoint behind authentication

We do not usually expose metrics publicly and there is no good reason
for handling aurweb differently.

Fixes: 74757d6b ("Scape aurweb metrics")