metadata: re-add MD.String with redaction of sensitive metadata (#9231)

Fixes #7395

MD.String was removed in #7372 because it could leak credentials orother
sensitive metadata when an MD was logged (e.g. via log(md)).etcd, the
main consumer relying on the old behavior, has since stoppeddepending on
it, so it is safe to re-add. This restores MD.String in aredacting form:
it prints keys and values only for a fixed allowlist ofnon-sensitive
gRPC/HTTP2 protocol headers, and omits (best effort) every other
keyentirely (key name included, since a key name may itself be
sensitive),reporting only the count as <N redacted>.

RELEASE NOTES:
* metadata: re-add MD.String, which now prints only an allowlist of
non-sensitive protocol headers and redacts all other metadata, to help
avoid accidentally logging credentials or other sensitive data