Show non-sensitive job metrics by default

There was a question on gitter how one can see the job runtime.
Currently it is either no metrics, or an admin needs to turn on
```
expose_potentially_sensitive_job_metrics
```

We should have a middle ground here. I think the core metrics shouldn't contain any sensitive information, but especially the runtime might be important for users to know.

Start by locating the expose_potentially_sensitive_job_metrics setting and the code that exposes job metrics. Define which core metrics, especially job runtime, can be available by default while sensitive metrics remain gated; done means non-sensitive metrics are visible without the admin setting and sensitive metrics still require it.

Written by the indexing model from the issue text.