server: Add param for diagnostic address binding

This adds a new config option for the OPA server (along with plumbing
from `opa run` downward to the server) to configure separate
diagnostic addresses to listen on. These will only be configured to
serve the /metrics and /health.

This will allow for more secure OPA deployments with the normal "data"
or "policies" API's made to be only accessible on localhost.

Fixes: #2002
Signed-off-by: Patrick East <east.patrick@gmail.com>