Add authorization support to trapperkeeper-metrics

The metrics routes are now covered by trapperkeeper-authorization, so access can be controlled from auth.conf (or the authorization section in general in the tk configuration). There is still a default embedded jolokia-access.xml which restricts access to localhost by ip which needs to be overridden by software intending to use tk-auth instead.