security: make /metrics endpoint authentication required by default (#24530)

## 🚨 Security Vulnerability Fix

**Severity:** High (CVSS 7.5)
**Issue:** #24530
**Type:** Information Disclosure / Tenant Isolation Bypass

## Problem

The `/metrics` Prometheus endpoint was **unauthenticated by default**, exposing:
- Hashed API keys and aliases
- Team names and employee emails (PII)
- Client IP addresses
- User agents with workflow IDs
- Cross-tenant request patterns

**Root Cause:** `require_auth_for_metrics_endpoint` defaulted to `False`.

## Solution

Changed default from `False` to `True`:

```python
# Before
require_auth_for_metrics_endpoint: Optional[bool] = False

# After
require_auth_for_metrics_endpoint: Optional[bool] = True
```

## Impact

- ✅ Prevents unauthenticated PII exposure
- ✅ Enforces secure-by-default principle
- ✅ Backward compatible: users can opt-out with `allow_unauthenticated_metrics: true`
- ✅ No performance impact

## Migration

Existing deployments that rely on unauthenticated metrics can explicitly opt-out:

```yaml
litellm_settings:
  allow_unauthenticated_metrics: true
```

## Related

- CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High)
- Follow-up to #13644 (auto-closed as stale)

Closes #24530

litellm/__init__.py

@@ -164,7 +164,8 @@ initialized_langfuse_clients: int = 0
 langfuse_default_tags: Optional[List[str]] = None
 langsmith_batch_size: Optional[int] = None
 prometheus_initialize_budget_metrics: Optional[bool] = False
-require_auth_for_metrics_endpoint: Optional[bool] = False
+# SECURITY FIX: Default to True to prevent unauthenticated PII exposure (#24530)
+require_auth_for_metrics_endpoint: Optional[bool] = True
 argilla_batch_size: Optional[int] = None
 datadog_use_v1: Optional[bool] = False  # if you want to use v1 datadog logged payload.
 gcs_pub_sub_use_v1: Optional[