provision: add get_{config,domain}_delete_protected*_descriptor()