Fix web server binding vulnerability and tests

Changed the `tiny_http::Server` to bind to `127.0.0.1` instead of
`0.0.0.0` in `stdlib/src/web.rs`. This prevents the server from
unintentionally exposing the port on all network interfaces.

Also updated the `TcpListener` in `stdlib/tests/stdlib_tests.rs`
to bind to `127.0.0.1` so that the port conflict test continues
to pass.

Co-authored-by: Tcode-Motion <188012755+Tcode-Motion@users.noreply.github.com>

Author: google-labs-jules[bot]

stdlib/tests/stdlib_tests.rs

@@ -430,7 +430,7 @@ fn test_web_module() {
 
     // Bind a listener to a random port to ensure the port is taken
     // Keep it alive to conflict
-    let listener = TcpListener::bind("0.0.0.0:0").unwrap();
+    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
     let port = listener.local_addr().unwrap().port();
 
     // Test panic on `start` when port is in use