Enforce protected labels

Enforce label protection through the API for applying labels,
removing labels, and creating events and superevents with labels
attached.  We also don't allow users to reapply a signoff request
label when a signoff status label is already applied (e.g., can't
apply ADVREQ when ADVNO already exists).