Right now we include configuration as metadata (which is later passed to
tracing callbacks).
Right now we include any key that doesn't have a dunder prefix and whose
value is a string or int.
This PR proposes to also exclude keys with certain substrings (key,
secret, token).
I would also be in favor of dropping support for forwarding configurable
values to metadata entirely, but this is a smaller, less controversial
change.
Add a test.
