adding config flags to control all items mentioned in PRIVACY.md

closes #3241
- in config.js, the `tinfoil` attribute holds all privacy-related flags
- `tinfoil: true` disables everything (equivalent to setting all flags to false)
- updating config.example.js with commented-out flags and description