Provide some minimal additional security

At least it's easy to turn on

nixos/modules/monitoring/server/grafana.nix

@@ -76,6 +76,11 @@ in {
       # listening.  Grafana's own server listens on an internal address that
       # doesn't matter to anyone except our nginx instance.
       rootUrl = "https://%(domain)s/";
+
+      extraOptions = {
+        # Defend against DNS rebinding attacks.
+        SERVER_ENFORCE_DOMAIN = "true";
+      };
     };
 
     services.grafana.auth = {