hubble: port-forward only to localhost

[kaworu]

Avoid exposing Hubble Relay and UI to the network, restrict to localhost. After the patch:

% ./cilium hubble port-forward
% ss -l -t 'sport = :4245'
State           Recv-Q          Send-Q                    Local Address:Port                     Peer Address:Port          Process
LISTEN          0               4096                          127.0.0.1:4245                          0.0.0.0:*
LISTEN          0               4096                              [::1]:4245                             [::]:*

and

% ./cilium hubble ui
% ss -l -t 'sport = :12000'
State           Recv-Q          Send-Q                   Local Address:Port                        Peer Address:Port         Process
LISTEN          0               4096                         127.0.0.1:entextxid                        0.0.0.0:*
LISTEN          0               4096                             [::1]:entextxid                           [::]:*

[rolinh]

The patch LGTM but with issue #1093 in mind, do we actually want to bind to the v6 address?

[tklauser]

I'd suggest to address that in a follow-up PR for #1093 specifically.