/config endpoints leak secrets

[wkloucek]

Describe the bug

The debug endpoints of the individual services feature a /config endpoint to view the configuration of a service.
The configuration includes secrets.

Expected behavior

One can not dump secrets via this endpoint.

Actual behavior

You can dump / view secrets in plain text on this endpoint. (Eg. curl localhost:9205/config | jq .MachineAuthAPIKey)

Additional context

As long as the debug endpoints are not exposed, the /config endpoint can not be accessed from the outside world. The debug endpoint does a bind to 127.0.0.1 by default.
Anyways, this needs to be changed anyways to a more secure approach.

cc @refs, @C0rby