Modify DataProtectionSecurityStateEncoder to use DataProtection instead of ProtectedData

We switched the CookieTransform to use DataProtection as it works cross platform, but we still are using ProtectedData in DataProtectionSecurityStateEncoder. We need to get the DataProtection instance from DI and plumb it through.

@birojnayak, it would be great to get this done before GA. If there isn't time, I'd like to make DataProtectionSecurityStateEncoder be internal so we can modify it later without any API breakage.