REST API: Warn about attack surface when setting http.host

`http.host` defaults to local, which is awesome. <3

However, now that we have an REST endpoint that allows modification of Logstash behavior, it is time to start down the path of securing this interface. At this time, the only mutation available is to set the logging level, so I don't think there are paths for escalation, so I will try to propose a minimal solution.

Proposal:

If `http.host` is set to anything other than the default, we should log a warning, on startup, indicating that this exposes Logstash to external systems and this may be undesirable.