[FIX] Disable debug/vars

[ZeljkoBenovic]

Description

For some reason, debug/vars URL endpoint on the json-rpc http API is enabled by default when DefaultServeMux is used, even though expvar package is not imported anywhere.

This presents a potential security issue and needs to be disabled by using NewServeMux function, instead of DefaultServeMux.

Changes include

• Bugfix (non-breaking change that solves an issue)
• Hotfix (change that solves an urgent issue, and requires immediate attention)
• New feature (non-breaking change that adds functionality)
• Breaking change (change that is not backwards-compatible and/or changes current functionality)

Checklist

• I have assigned this PR to myself
• I have added at least 1 reviewer
• I have added the relevant labels
• I have updated the official documentation
• I have added sufficient documentation in code

Testing

• I have tested this code with the official test suite
• I have tested this code manually

Manual tests

Compile binary from this branch and query debug/vars GET endpoint on JSON-RPC API. For example: localhost:8545/debug/vars. You should get the default GET output.

Additional comments

Fixes EDGE-856

[zivkovicmilos]

Good catch 💯