Clarify localhost usage in security documentation

[mx-psi]

          Hi, just wanted to suggest that you have somewhere in the docs a warning about the case where `localhost` gets resolved via DNS to some real address and things go very weird.  This has happened enough times to me that I reflexively type `127.0.0.1` instead, but I recognize that ipv6 is a thing.

Originally posted by @bboreham in #8510 (comment)

[professorabhay]

Hey, Take a look to that!

Warning: DNS Resolution for 'localhost'

When configuring security settings or specifying network endpoints, it's common to use the hostname 'localhost' to refer to the loopback interface (IPv4 address 127.0.0.1). However, it's crucial to be aware that in some network configurations, 'localhost' may be subject to DNS resolution, leading to unexpected behavior.

In situations where 'localhost' is resolved to an actual IP address other than the loopback interface, security risks may arise. This can result in unintended exposure of services or data to external networks.

To mitigate this risk, consider using the explicit loopback IP addresses:
- IPv4: 127.0.0.1
- IPv6: ::1

Additionally, if IPv6 is in use, ensure that your applications and security configurations support both IPv4 and IPv6 loopback addresses to avoid any compatibility issues.

For added clarity and consistency, it is advisable to explicitly specify the loopback IP address instead of relying solely on the 'localhost' hostname, especially in security-critical configurations. This practice helps ensure that your applications behave predictably across different network environments.

[mx-psi]

@professorabhay Would you be open to filing a PR to add this under this section https://github.com/open-telemetry/opentelemetry-collector/blob/main/docs/security-best-practices.md#safeguards-against-denial-of-service-attacks ?

[professorabhay]

Sure @mx-psi!
Are there any changes you want to see?

[mx-psi]

We can discuss in the PR itself, it's easier to make comments there

[Sanket-0510]

Hey @mx-psi this is open from a week without any PR, I would like to address this one. I believe we can address this in more simple and precise language for users to understand. I would like to raise PR for the same.

When setting up security or specifying network locations, people often use 'localhost.' Be cautious! In some setups, 'localhost' might undergo DNS resolution and end up with an unexpected IP, risking security.

Risk Alert:
If 'localhost' resolves to a different IP due to DNS, your data might accidentally leak outside.

How to Stay Safe:
Always use these IPs instead:

IPv4: 127.0.0.1
IPv6: ::1
IPv6 Reminder:
If you're using IPv6, make sure your system supports both IPv4 and IPv6 loopback addresses to avoid issues.

Top Tip:
For clarity and safety, directly mention the IP (127.0.0.1) instead of relying only on 'localhost,' especially in sensitive setups. Keep things consistent across different networks.

[mx-psi]

Fixed by #9444