Add auth to `/debug/vars` and `/debug/pprof`

It is not currently possible to enable `/debug/vars` and `/debug/pprof` in Elasticsearch Service, as these endpoints do not honour auth configuration. I would like to be able to use these endpoints for performance analysis.

When either secret token or API Key auth is enabled, these endpoints should require API Key auth, using a new privilege (TBD). It will be an error to attempt to configure these endpoints with a secret token set but API Key auth disabled.

Once that is done we should allowlist the config to enable these endpoints, and possibly enable them by default.