fix: replace http.DefaultServeMux fallback handlers with safe defaults

The HTTP server uses http.DefaultServeMux as the fallback handler
for unmatched routes and disallowed methods. Since DefaultServeMux
is a global shared instance that may have handlers registered by
init() functions (e.g. net/http/pprof), this can unintentionally
expose debug endpoints like /debug/pprof/ to the network.

Replace with:
- http.NotFoundHandler() for NotFoundHandler (returns 404)
- A simple 405 handler for MethodNotAllowedHandler

Users who need the previous behavior can still explicitly set
http.DefaultServeMux using the existing NotFoundHandler() and
MethodNotAllowedHandler() server options.

Fixes go-kratos#3810

Author: Yanhu007

transport/http/server.go

@@ -189,8 +189,10 @@ func NewServer(opts ...ServerOption) *Server {
 		strictSlash: true,
 		router:      mux.NewRouter(),
 	}
-	srv.router.NotFoundHandler = http.DefaultServeMux
-	srv.router.MethodNotAllowedHandler = http.DefaultServeMux
+	srv.router.NotFoundHandler = http.NotFoundHandler()
+	srv.router.MethodNotAllowedHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusMethodNotAllowed)
+	})
 	for _, o := range opts {
 		o(srv)
 	}