Add deployment guidance for self-hosted Gremlin Server

[kmcginnes]

Summary

Our security reference explains that Graph Explorer performs no authentication, but it said nothing about the script engine the connected database runs. A deployer pointing Graph Explorer at a self-hosted Gremlin Server had no guidance on what the default Groovy engine means for who should be able to reach the app.

docs/
├── references/security.md                   # new: Self-hosted Gremlin Server
├── guides/connecting-to-gremlin-server.md   # local-development warning
└── getting-started/README.md                # corrected network claim
samples/air_routes/
├── README.md                                # names the script engine
├── docker-compose.yaml                      # app published on loopback
└── sample/conf/gremlin-server-air-routes.yaml

The new section states TinkerPop's documented position, points at their own server-side configuration docs, and notes that Amazon Neptune doesn't use Groovy. It stops short of recommending the gremlin-lang engine, because Graph Explorer can't talk to a server configured that way yet (#2379).

Evidence

Before: the security reference covered access control but not the database's script engine, and the getting-started note claimed the sample serves Graph Explorer on every network interface.
After: the reference has a Self-hosted Gremlin Server section, the Gremlin Server guide and the sample both link to it, and the getting-started note matches what the Compose file does.

Verified live: the air routes sample on Gremlin Server 3.8.2, loading 3749 vertices and 57645 edges. Schema sync through the UI, with the app reachable only on loopback.

Merge Danger

Door: two-way

Impact: sample reachability

The Compose file now publishes Graph Explorer on 127.0.0.1 instead of every interface. Anyone who reached the sample from another machine needs to change that binding back or tunnel to it.

Related

• Related to Initiative: Deployment guidance for access control, follow-ups #2377
• Related to Remove exposed ports for database in air routes sample #1054
• Related to Let a Gremlin connection send language: gremlin-lang with each request #2379

[kmcginnes]

Approved