derp/derpserver: data race in expvar metrics

[bradfitz]

derp/derpserver/derpserver.go has an expVarFunc helper to handle Server mutex locking/unlocking for expvar.Funcs, but a couple metrics don't use it and thus have data races.

Thanks to Khaled M. Alshammri for the report.