Deletion protection for Postgres

### Required Terms

- [X] I agree to follow this project's [Code of Conduct](https://github.com/heroku/roadmap/blob/main/CODE_OF_CONDUCT.md)
- [X] I have read and accept the [Salesforce Program Agreement](https://www.salesforce.com/company/program-agreement/)

### What service(s) is this request for?

Heroku dynos, Postgres, Add-ons

### Tell us about what you're trying to solve. What challenges are you facing?

I'd love the ability to prevent accidental deletion of databases and perhaps dynos, add-ons, etc.

Story time - a few years back we had our largest downtime/data-loss event ever as a result of accidental deletion. Every seasoned developer has their horror story; this is mine.

The previous week we'd rolled out a massive update including a new server architecture. To test the new system, we deployed the code to a new set of dynos, attached the add-ons, and ran both code-bases in parallel. Finally we redirected traffic to the new dynos then put the old dynos in maintenance mode for several days. A complex migration completed without a hitch. Or so I thought.

Later that week, I went into Heroku to remove the old dynos which has been in maintenance mode for several days. Within seconds my phone was blowing up. Our database was gone.

Ends up, add-ons like Postgres can be attached to multiple dynos but the first one is the magical "main" dyno. Deleting that dyno automatically and implicitly deletes databases/add-ons/etc, even if they are attached to other dynos.

But we have automatic backups and live-replicas, right? Wrong - support says these are non-recoverable if the database is deleted. We do daily off-site backups but those would be missing hours of data. After a day of downtime, support was able to restore the database and we only lost about 17 minutes of data. Logging let us identify customers who had data loss and we contacted each of them.

More transparency about what will be deleted would be much appreciated. Softer deletes would be nice. External replicas would be amazing. But deletion protection would be a great catch-all.