chore(api): harden HTTP server initialization based on Gosec (G112, G114)

[schen6318]

Summary

This pull request addresses security concerns raised by Gosec regarding the use of insecure HTTP.server configurations in the Kubernetes Dashboard API and related components.

Purpose

The goal is to enforce safe usage of the Go http.Server by ensuring proper timeout settings are applied to avoid risks such as:

• Unbounded request durations (G114 / CWE-676)
• Potential Slowloris attacks due to missing ReadHeaderTimeout (G112 / CWE-400)

Implementation

This PR resolves two classes of security warnings:

• G114 (CWE-676): Avoid usage of http.ListenAndServe / ListenAndServeTLS directly, which provide no timeout control.
  Replaced these calls with structured http.Server configurations including:

1. ReadTimeout;
2. WriteTimeout;
3. IdleTimeout;

• G112 (CWE-400): Added missing ReadHeaderTimeout to structured servers to prevent Slowloris-style DoS attacks.

Notes

These changes are based on security findings from Gosec.
No application logic is modified — only server initialization is hardened.
All warnings have been resolved in subsequent Gosec scans.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: schen6318
Once this PR has been reviewed and has the lgtm label, please assign shu-mutou for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment