Potential fix for code scanning alert no. 50: Server-side request forgery

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: aias00 <liuhongyu@apache.org>

hertzbeat-warehouse/src/main/java/org/apache/hertzbeat/warehouse/controller/MetricsDataController.java

@@ -99,6 +99,11 @@ public class MetricsDataController {
         String app = names[0];
         String metrics = names[1];
         String metric = names[2];
+        // Validate metrics against a whitelist
+        List<String> allowedMetrics = List.of("cpu", "memory", "disk", "network"); // Example whitelist
+        if (!allowedMetrics.contains(metrics)) {
+            throw new IllegalArgumentException("metrics name: " + metrics + " is not allowed.");
+        }
         MetricsHistoryData historyData = metricsDataService.getMetricHistoryData(monitorId, app, metrics, metric, label, history, interval);
         return ResponseEntity.ok(Message.success(historyData));
     }