Check the protected content bit and return the right value
Protected content swapchain creation is described (briefly) in OpenXR, but is not required. If it's not available, a specific error code is required to be returned. This handles that in a few parts:
- Adds an xrt_result_t code to distinguish "that was a fine flag, but we don't support it, and that's OK too" from "app was bad" or "runtime was bad" errors.
- Make our standard main compositor return that new code on seeing the protected content bit set.
- Handle that new result code in the state tracker, in turn returning the correct code for OpenXR.