Fix: Deny passwordless access to prometheus API if readonly access is disabled

Fix #1358

src/WebApi_prometheus.cpp

@@ -25,6 +25,10 @@ void WebApiPrometheusClass::loop()
 
 void WebApiPrometheusClass::onPrometheusMetricsGet(AsyncWebServerRequest* request)
 {
+    if (!WebApi.checkCredentialsReadonly(request)) {
+        return;
+    }
+
     try {
         auto stream = request->beginResponseStream("text/plain; charset=utf-8", 40960);