Require protected memory support when creating protected queue

According to VUID-VkDeviceQueueCreateInfo-flags-02861, the
protectedMemory feature must be enabled if the
VK_DEVICE_QUEUE_CREATE_PROTECTED_BIT flag is specified. When using debug
builds of the ARM Mali Vulkan ICD that don't support protected memory,
specifying that flag anyway was causing an assert in the ICD, so don't
attempt to create a protected device if the physical device doesn't
support protected memory.

Bug: b/312107548
Change-Id: I74c162ba90ea582b403a44d362932eac9b6fa66f