Indication of data classification level on form itself and on responses

## Context

From client using the API:

> Also, it would be nice if form submissions or at least the form template included a field for Protected A, B or unclassified. This way client system that are generic enough to process any GC Forms form can adjust their behaviour based on the protected level. Perhaps this information is available on an export of a form in the UI, but it does not appear to me to be available at runtime from the API. Unless I missed something.

Start by tracing how the form template and form submissions are represented and exposed through the API at runtime. Determine where a Protected A, Protected B, or unclassified value could be surfaced for generic client systems; done means the classification is available on the form or submissions as specified and covered by the relevant API behavior.

Written by the indexing model from the issue text.