Config loading doesn't actually validate / default anything

[asottile]

Things I'd like to do

1. Allow for metrics and metric_expressions to be left blank and defaulted
2. Validate that the metric names all exist in the loaded metrics (requires a db call)

[asottile]

I'm not sure I'm comfortable solving part 2 of this issue at runtime due to needing a database access. I might instead opt for a script that validates the configuration instead.