Add protected branch policy

What

Adds ProtectedBranchPolicy and uses it from both the API and the Controller.

Why

This will be used in EE where we want per rule control over who can update/destroy a protected branch rule.

Does this MR meet the acceptance criteria?

• Changelog entry added, if necessary
• Documentation created/updated
• API support added
• Tests added for this feature/bug
• Review
  • Has been reviewed by Backend
• End-to-end tests pass (package-and-qa manual pipeline job)

Related

First part of https://gitlab.com/gitlab-org/gitlab-ee/issues/4800