Moving project telemetry reporting from the update module into core

This sounds like a good idea. More accurate usage data is a good thing.

Decide if it should be opt-in or opt-out.

My default position is opt-in, but we should definitely encourage sites to opt-in, highlighting the benefits of doing so, linking to a privacy statement, etc.

Having said that, I personally wouldn't object to an opt-out strategy, as long as it was very clear to users that they can opt-out and the implications of staying "in" are clearly communicated.

At the end of the day I think it comes down to how we communicate it and where we choose to place the option.