safekeeper,pageserver: fix CPU profiling allowlists

[erikgrinaker]

Problem

The HTTP router allowlists matched both on the path and the query string. This meant that only /profile/cpu would be allowed without auth, while /profile/cpu?format=svg would require auth.

Follows #9764.

Summary of changes

• Match allowlists on URI path, rather than the entire URI.
• Fix the allowlist for Safekeeper to use /profile/cpu rather than the old /pprof/profile.
• Just use a constant slice for the allowlist; it's only a handful of items, and these handlers are not on hot paths.

[github-actions]

5561 tests run: 5344 passed, 0 failed, 217 skipped (full report)

---

Flaky tests (3)

Postgres 17

• test_sharding_split_failures[failure17]: debug-x86-64
• test_tenant_relocation[without_load-minor]: debug-x86-64

Postgres 15

• test_pull_timeline[True]: release-x86-64

Code coverage* (full report)

• functions: 31.4% (7955 of 25337 functions)
• lines: 49.3% (63105 of 128000 lines)

* collected from Rust tests only

---

_{The comment gets automatically updated with the latest test results
91cc48e at 2024-11-22T17:53:22.732Z :recycle:}