terraform: let a record set opt out of change protection

Deleting a protected set takes two applies: first protected = false,
then remove it. Used for gf/AAAA (removed).

Assisted-by: Claude:opus-5-5

terraform/dns.tf

@@ -143,6 +143,7 @@ resource "hcloud_zone_rrset" "rr" {
   name     = each.value.name
   type     = each.value.type
   ttl      = try(each.value.ttl, null)
-  change_protection = !can(regex(local.unprotected, each.value.name))
+  # A set can opt out with protected = false (e.g. to delete it next apply)
+  change_protection = try(each.value.protected, !can(regex(local.unprotected, each.value.name)))
   records           = [for value in each.value.records : { value = value }]
 }