Decouple the metrics endpoint from debug

[ialidzhikov]

Similar to #4084.

There is a /debug/metrics endpoint that gets available when the debug.addr is specified and debug.prometheus.enabled is enabled (ref https://docs.docker.com/registry/configuration/#prometheus).
Note that the docs suggest not enabling this in production env:

Sensitive information may be available via the debug endpoint. Please be certain that access to the debug endpoint is locked down in a production environment.

Having in mind the above, how is it supposed to collect metrics in production environments? The docs state that the debug feature has to be disabled in production environments. On the other side, it is a cloud native and observability principle to collect metrics in all environments.
I rather thing that the metrics endpoint has to be decoupled from debug and it needs to have its own configurable port and its own configuration option whether it is enabled or not.

[milosgajdos]

Note that the docs suggest not enabling this in the production env

No, the docs are suggesting to lock it down i.e. do not leave it open to public -- you know people on the internet can be kinda mean.

That doesnt mean that you can't keep this API endpoint private and scrape prometheus metrics as you do in our other applications

[ialidzhikov]

Thanks! It seems that we misunderstood the docs. I created #4089 to clarify further the docs.