refactor(core): split app_protection.sh data from logic

The 1912-line app_protection.sh mixed protected-bundle data arrays with
matching/policy code, making "add a bundle ID" PRs hard to review against
"change protection policy" PRs. Move the readonly SYSTEM_CRITICAL_BUNDLES_*,
APPLE_UNINSTALLABLE_APPS, and DATA_PROTECTED_BUNDLES arrays into a new
app_protection_data.sh that contains data only.

Logic stays in app_protection.sh and sources the data file at load time.
No behavior change. Tests cover should_protect_from_uninstall /
should_protect_data via tests/uninstall_safety.bats.