The OTLP/gRPC trace listener was binding to 0.0.0.0 by default, exposing
the unauthenticated trace service to the network. This allows any host on
the same network to inject fake spans or exfiltrate collected trace data
(which may contain sensitive attributes like API keys and HTTP headers).
Bind to 127.0.0.1 (localhost) by default so the trace listener is only
accessible from the local machine.
CWE-287
