Prevent destroy-environment when desired.

Customers and stakeholders want to be able to prevent accidental damage to their Juju deployments by activating environment settings which prevent destroy-environment. 

When on, this setting needs to be manually deactivated prior to the protected operations being allowed.

"force destroy-environment" ignores this setting.