We made it possible to enable `protected_secrets` via the installer surface, it is disabled by default. https://github.com/gitpod-io/gitpod/pull/13484 The intended outcome of this issue, is to ship `protected_secrets` as enabled by default.
