Implement "Block pipelines on protected branches"

What does this MR do?

Forbid creating/cancelling/retrying pipeline/jobs if:

• It's a tag and it's protected and the user cannot create the tag
• It's a branch and it's protected and the user cannot merge or push to the branch

Does this MR meet the acceptance criteria?

• Changelog entry added, if necessary
• Tests
  • Added for this feature/bug

What are the relevant issue numbers?

Closes #30634 (closed), #34616