Breaking changes to consider for foundations 6

[TheJokr]

This is a tracking issue to compile breaking changes we want to consider before releasing foundations 6.

[TheJokr]

foundations::security::allow_list generates once_cell::sync::Lazy instances in user code. We should consider switching this macro to use std::sync::LazyLock instead, which allows us to drop our once_cell dependency completely. (See also #157)

[TheJokr]

Metric functions with and without labels have a subtle difference in behavior: unlabeled metrics are emitted with their default value immediately, while labeled metrics are only created on first usage. (Naturally, since we can't know the labels ahead of time.)

This can cause a lot of uninteresting metrics to be emitted when only part of a metrics-enabled library is actually executed.

Making unlabeled metrics behave like labeled ones, by initializing them on first use, would make foundations' metrics handling more consistent and avoid wasting storage in such cases. However, zero values in prometheus are useful (e.g. for rate() calculations), so maybe we should offer both options?