Clarify the difference between protection and protection flags, which has been a source of confusion for multiple teams. Also added documentation about the `internal` protection. Test: presubmit Change-Id: I72d1a9b5030eabdabecff3983cf299d469dd9910