[secretfilter] Add metrics to track the redaction of secrets

[kelnage]

PR Description

When the secretfilter component reacts secrets from log data, it is currently challenging to track how many secrets have been redacted, where they were redacted from, and how the component performs without expensive queries over Loki. This PR introduces multiple metrics to enable these to be tracked.

Which issue(s) this PR fixes

Notes to the Reviewer

I'd be very interested in your thoughts on the value of each of these metrics and my design choices around them. I would consider the loki_secretfilter_secrets_redacted_by_rule_total and loki_secretfilter_secrets_redacted_by_origin to be the key metrics - but I think each of the others would also have some value. Arguably loki_secretfilter_secrets_redacted_total could be determined directly from loki_secretfilter_secrets_redacted_by_rule_total - would it be better to just have the latter?

PR Checklist

• Documentation added
• Tests updated

[github-actions]

💻 Deploy preview deleted.

[clayton-cornell]

Docs look OK for now. I'll wait on final approve for docs until after code review.

[wildum]

Thanks for adding this and for all the tests, this is great!
Only two small remarks:

• the changelog entry is missing
• it would be nice to have a little bit more test coverage for the update behavior in the tests: ensuring that existing metrics are not reset between two updates + what happens if I update with a different origin label and then update back to the previous origin label? Will I start from the previous value or from 0?

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[kelnage]

@wildum hope the new test matches your expectations - helpfully it also revealed a bug with updating the allowlists (it didn't clear the old allowlist) 👍 The failing tests seem completely unrelated to my changes post-merging in main, and are possibly just flakey tests.

[dehaansa]

Re-running the test to confirm flakiness, and we'll need an updated changelog as this just missed the RC for 1.8.