swarm-otel: scrape grafana through its published name

Grafana's own metrics were scraped over loopback through the
`grafana-metrics` nginx vhost, declared only where grafana and the
collector share a host, so a collector on any other host had no job for
it. Its target is now declared on every host as
`https://<swarm.grafana.domain>/metrics`, next to the other published
targets, and grafana's vhost serves `= /metrics` behind the collector's
auth subrequest (`/__grafana_metrics_authz`, the forge's shape). The
rules derived from `publishedScrapeTargets` admit the collector's client
there and deny every other subject.

The loopback scrape is gone with the vhost that served it and its
`swarm.grafana.metricsPort` option, so a single host still scrapes
grafana once, now by name. A config that sets that option now fails
evaluation with "option does not exist".

On the published vhost `/metrics` was answered with 403 for everyone.
It now answers the collector's token, and a plain session gets authelia's
`deny`. The design note that ruled the published vhost out for scraping
predates the collector's credential; it is replaced by the location's
own comment and a line on `swarm.grafana.domain`.

Part of #5205

nix/host-modules/swarm-otel-service.nix

@@ -362,5 +362,7 @@ in
     victoriametrics = "https://${vmCfg.domain}/metrics";
     # The vhost location is in ./swarm-victorialogs.nix.
     victorialogs = "https://${hyperhiveCfg.swarm.victorialogs.domain}/metrics";
+    # The vhost location is in ./swarm-grafana.nix.
+    grafana = "https://${hyperhiveCfg.swarm.grafana.domain}/metrics";
   };
 }