bootstrap: add configurable ReadHeaderTimeout to the HTTP server

The *http.Server built by Runner.newServer left ReadHeaderTimeout unset,
so request-header reads were unbounded -- a Slowloris-style connection
exhaustion vector (gosec G112). The exporter-toolkit web package does not
set server timeouts either, so every bootstrap-based exporter inherited
the gap.

Add a ReadHeaderTimeout field to bootstrap.Config, defaulting to one
minute when unset. It bounds only header reading, not the metrics
handler, so it never affects legitimate scrapes, and -- like every other
Config field -- downstream exporters can tune it to their own needs.

Follow-up to prometheus/blackbox_exporter#1626, which made the same change
on the caller side; setting it here fixes it once for all toolkit users.

go build, go vet, and go test ./... (incl. -race) pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: randomizedcoder dave.seddon.ca@gmail.com <dave.seddon.ca@gmail.com>