Enable health check only management port

Issue #2579 added the ability to bind health checks to a specific port so they're only visible to internal components. Good stuff.

However, it turns out you can't _dedicate_ the port to management/health check purposes. That is, if there's a "main port" for handling other requests and a "management port" for handling health requests... you can still make all requests over that management port that you would over the main port. Setting a port on health checks means the health checks only listen on that port... but the rest of the app (e.g., the MVC middleware) is still listening on all ports.

It would be nice if you could specify the health check port and have that be an exclusive handler on that port - _only_ health checks would respond on that port.

Granted, this is easy enough middleware to write oneself, which is what I'll end up doing to work around it, but it'd be helpful if this was supported out of the box.

My general use case here is Kubernetes and Istio using mTLS authentication. I want Kubernetes to be able to do [readiness/liveness checks on a specific port that bypasses the mTLS because you can't make Kubernetes use the specified certs for those checks](https://istio.io/docs/tasks/traffic-management/app-health-check/) but I don't want to leave the "back door" open for all the other services in the cluster to bypass the mTLS auth by making calls on the port I leave open for the health checks.