Enforce internal_port gating of builtin services in pb protocols

[chenBright]

What problem does this PR solve?

Issue Number: resolve

Problem Summary:

ServerOptions.internal_port is documented to make builtin services (and
Tabbed services, see the comment on internal_port) reachable only from the
internal port. ServerOptions::security_mode() returns true once it is set.

Only the http/h2 dispatch path actually enforced this. Every pb protocol
computed the same security_mode flag but used it just for address obfuscation
in AppendServerIdentiy(), and had no check at all between method resolution
and CallMethod(). Since builtin services share _method_map with user
services, they can be addressed by name over pb.

With internal_port configured, a client on the public port can therefore reach builtin
services that the http path returns 403 Forbidden for on the very same server. For
example, brpc.vars dumps the full metrics set, andhotspots is reachable the same
way.

Affected dispatch paths: baidu_std, hulu_pbrpc, sofa_pbrpc, and all
nshead-based pb protocols (public_pbrpc, nshead_mcpack, nova_pbrpc,
ubrpc2pb), which share NsheadPbServiceAdaptor::ProcessNsheadRequest.

What is changed and the side effects?

Changed:

Side effects:

• Performance effects:

• Breaking backward compatibility:

---

Check List:

• Please make sure your changes are compilable.
• When providing us with a new feature, it is best to add related tests.
• Please follow Contributor Covenant Code of Conduct.