Merge "Allow profile owners to protect packages." into tm-dev