protectedts: MakeSchemaObjectsTarget should protect the schema object's metadata

**Describe the problem**

Users of the protected timestamp system (Changefeeds, LDR, BACKUP/RESTORE, etc) often want to assume that if they have a protected timestamp on a table, then they will be able to do things such as issue a historical SQL query, get the correct table descriptor to parse datums on that historical data, and so forth.

However, that currently is not the case. A protected timestamp on a table does not protect that table's namespace or descriptor table rows. While callers could be updated to additionally protect those two tables, those callsites then need to always understand all of the tables that should be protected to plan an arbitrary query against a given table.

It would be nice if we had an API for creating a protected timestamp that protected both the table and all relevant metadata for that table.

Jira issue: CRDB-40397

Epic CRDB-61004