Option to make variables protected by default

What does this MR do?

Adds an application setting allowing an admin to change the default for ci variables to be protected. This allows to override the current default false to true on an instance level.

The development of this MR is sponsored by @ siemens (/cc @bufferoverflow).

What are the relevant issue numbers?

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/51822

Does this MR meet the acceptance criteria?

• Changelog entry added, if necessary
• Documentation created/updated
• Tests added for this feature/bug
• Conforms to the code review guidelines
• Conforms to the merge request performance guidelines
• Conforms to the style guides
• Conforms to the database guides
• Link to e2e tests MR added if this MR has Requires e2e tests label. See the Test Planning Process.