Protected default affiliations

For GiveCampus school settings.

School affiliation management is included in Superadmin, Fundraising Superadmin, or School-Level Settings Admin. Built-in default affiliation records cannot be edited or deleted even by those roles. A built-in affiliation with disabled editing can therefore be protected configuration, not a general access failure. Have support review the actual record and supported year update; do not delete/recreate a default affiliation to bypass the lock.