fix(http): bind to loopback by default

[aniruddhaadak80]

Summary

Default HTTP mode to a loopback bind address, reducing accidental network exposure while preserving an explicit all-interfaces option for containers and reverse proxies.

Why

Fixes #3327

What changed

• Change the --listen-host default from all interfaces to 127.0.0.1.
• Keep explicit 0.0.0.0 and empty-host behavior available for intentional all-interface deployments.
• Document the default and add coverage for the CLI default and all-interface address resolution.

MCP impact

• No tool or API changes
• Tool schema or behavior changed
• New tool added

This changes only the HTTP server's default bind address; MCP tools and API behavior are unchanged.

Prompts tested (tool changes only)

N/A

Security / limits

• No security or limits impact
• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered

The loopback default reduces accidental network exposure. Deployments that intentionally need all interfaces must opt in with --listen-host 0.0.0.0.

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Passed in the affected packages:

• go test -race -count=1 . in cmd/github-mcp-server
• go test -race -count=1 . in pkg/http
• go vet . in both packages
• The pinned golangci-lint reported 0 issues before the Windows runner timed out.

Docs

• Not needed
• Updated (README / docs / examples)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.