[HIGH] Bind remote debugging to localhost by default

[OskarEichler]

Summary

• Bind both remote-debugging listeners to localhost when callers omit the host.
• Preserve explicit remote access: callers can still pass 0.0.0.0, ::, or a specific interface.

Security impact

Byebug.start_server and Byebug.start_control currently default their host to nil. On Ruby, TCPServer.new(nil, port) binds the wildcard address (observed as :: on macOS), exposing the debugger and control ports on every interface.

The debugger protocol has no authentication and accepts commands that execute in the stopped process binding. A developer who enables remote debugging without passing a host can therefore unintentionally give any reachable network peer debugger-level code execution in that process.

A focused reproduction on Ruby 4.0.6 reported:

TCPServer.new(nil, 0):       address "::"
TCPServer.new("localhost", 0): address "::1"

Verification

• Focused instrumentation confirmed no-argument startup passes localhost to both listeners.
• Explicit 0.0.0.0 remains unchanged for callers intentionally accepting remote connections.
• Existing remote-debugging coverage: 9 runs, 9 assertions, 0 failures.
• Ruby syntax, whitespace checks, native extension compilation, and gem build passed on Ruby 4.0.6.
• The full suite completed 522 runs and 770 assertions with the same 13 known Ruby 4 backtrace-layout failures and 2 skips present on current main; this two-line networking-default change added no failures.

No new tests were added under the consumer audit's no-new-tests constraint.

Breaking change

Yes, intentional: applications that relied on Byebug.start_server or Byebug.start_control with no host to accept non-loopback connections must now pass an explicit bind address such as 0.0.0.0 or ::. This makes network exposure opt-in.

Scope and limitations

This change reduces accidental exposure. It does not add transport authentication or encryption, so explicitly exposed remote-debugging ports must still be protected by host/network controls.