Protected default affiliations

For GiveCampus school settings.

The policy requires school-setting management permission and rejects edits/updates/deletion of gc_default affiliation records. A built-in affiliation with disabled editing can therefore be protected configuration, not a general access failure. Have support review the actual record and supported year update; do not delete/recreate a default affiliation to bypass the lock.