Use istio fault to block gitlab metrics through virtualservice

Gitlab metrics are enabled and being scraped by prometheus. However, if you don't use a default whitelist, then the metrics are available to 0.0.0.0/0, aka globally:

https://docs.gitlab.com/ee/administration/monitoring/ip_allowlist.html

Additionally, since we use istio as our ingress, even if we did choose to set up an IP whitelist, all customer traffic that comes through the ingress appears as internal traffic to Gitlab webservice pods. Therefore, we would like for Big Bang to implement istio http fault on the virtualservice to route anyone that goes to https://<GitlabURL>/-/metrics to be routed into a black hole. Big Bang already does this in Anchore. Here is an example of what one might look like once it is templated. Since prometheus goes straight to the gitlab service/pods, it should be unaffected by this, and only external consumers will then rightfully be unable to scrape instance metrics. Note that in our testing, it had to go above any other rule so that it was hit first:

spec:
  gateways:
  - istio-system/main
  hosts:
  - gitlab.dso.mil
  http:
  - fault:
      abort:
        httpStatus: 400
        percentage:
          value: 100
    match:
    - uri:
        prefix: /-/metrics
    route:
    - destination:
        host: doesnt-really-matter
        port:
          number: 1111

Acceptance criteria

• Anyone that goes to https://<GitlabURL>/-/metrics receives an error instead of receiving a full readout of the Gitlab instance metrics
• Prometheus Gitlab metrics continue to function