Bind OPA server to localhost interface by default

Currently OPA binds to the 0.0.0.0 interface by default, which allows
the OPA server to be exposed to services running outside of the same machine.
Though not inherently insecure in a trusted environment, it's good practice
to bind OPA to the localhost interface by default if OPA is not intended
to be exposed to remote services.

This change also adds a new feature flag to `opa run` to allow users to enable
future OPA compatible behavior.

Fixes: #6286

Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>