Define (or document) appropriate NetworkPolicy/AuthorizationPolicy to prevent user access to autoscaler

/area autoscale

## Describe the feature

Out of the box, the autoscaler listens for websocket connections so that activators can tell it about request metrics. Nothing, though (afaik), currently prevents a random user/pod sending data to this websocket, which might be exploited by malicious users to e.g. spuriously scale other user's pods. We assume operators will set up appropriate NetworkPolicy or (if using istio) AuthorizationPolicy to prevent this, but we do not - unless I missed it - document this fact.

We should _at least_ :

- [ ] document this clearly for operators

but It would also be nice to:

- [ ] ship a NetworkPolicy to prevent this access, possibly together with https://github.com/knative/serving/issues/8959
- [ ] potentially also (bonus points), in net-istio at least, add AuthorizationPolicy to block this at the mesh level