Add 'protected' column to labels and apply it

Add a boolean column called 'protected' to the Label model.
Protected labels will not be allowed to be directly applied, but
will be applied as a part of another process (like signoffs).
We also create a data migration which sets some existing labels
as protected (ADV(OK|NO), (H1|L1|V1)(OK|NO))