Enhance SAF with app protection

As discussed with @grote, the current SAF's behaviour is unclear to users.

When selecting app protection we should
- explain that when enabling no SAF is working anylonger
- show if persistent uri access is granted
- have checkbox "delete persistent uri access", if above is true
- opt-out to keep these, e.g. for seedvault
- https://developer.android.com/reference/android/content/ContentResolver#getPersistedUriPermissions()