refactor: remove global DefaultServeMux dependency in pprof server

[luojiyin1987]

Description

The servePprof() function in cmd/web.go currently uses http.DefaultServeMux via a blank import of net/http/pprof. This is problematic because:

1. Isolation: Global mux can be polluted by other packages
2. Maintainability: Implicit handler registration is harder to track
3. Security: Other code could accidentally expose endpoints via DefaultServeMux

Proposed Solution

• Replace blank import _ "net/http/pprof" with explicit import "net/http/pprof"
• Create a dedicated http.ServeMux for the pprof server
• Register pprof handlers explicitly

Related

PR: #36276