Revisit PROTECT()ing objects passed to setAttrib()

[MichaelChirico]

          Relying on ii) also violates Tomas Kalibera's suggestion on [callee-protection](https://blog.r-project.org/2019/04/18/common-protect-errors/)

Historically, some core R API functions are callee-protect, they protect their own arguments and keep them protected for the whole duration of their call. It is better not to rely on this property, but it is often done and rchk tries to detect callee-protect functions and not report an error.

Originally posted by @ben-schwen in #6265 (comment)

CRAN_Release specifically calls out our assumption that we don't need to PROTECT() objects passed to setAttrib(), but a note in {rchk} calls out that we shouldn't do so.

[MichaelChirico]

@ben-schwen also points out we probably shouldn't need PROTECT() for any getAttrib() usage:

#5446 (comment)

https://github.com/search?q=repo%3ARdatatable%2Fdata.table%20%2FPROTECT%5B(%5DgetAttrib%2F&type=code

[ben-schwen]

@ben-schwen also points out we probably shouldn't need PROTECT() for any getAttrib() usage:

#5446 (comment)

https://github.com/search?q=repo%3ARdatatable%2Fdata.table%20%2FPROTECT%5B(%5DgetAttrib%2F&type=code

Apparently its a bit harder than that:
See also here