Fix #804: Delay protect() mechanism until desugaring.

The fix is decomposed in two commits. In the first commit the `compiler/` is untouched, so that we can simulate a binary compatibility scenario and verify that the deserialization-time fix works.

The second commit cleans up the compiler not to emit raw `JSApply`s anymore.
Support IR needs to typecheck, of course! That's not a philosophical question: optimizations rely on the well-typedness of the IR.
However, old IR *will* still typecheck even if we `protect` here, because the only `protect` that can happen are eliminated by the deserializer here:
https://github.com/scala-js/scala-js/pull/806/files#diff-f4bb4a76b1cb809bf2ad8a921ebd18faR592

The mere fact that this commit builds is the "proof by example", since in the first commit the compiler still emits protects, and yet the test suite passes with the IR checker enabled.