and --delete-excluded), append a protect-filter rule onto the list of
filter rules.  We run this on both the client and server side so that
an older client talking to a newer server still gets the protection
rule.  (This rule will not cause compatibility problems with older
versions of rsync due to the graceful way that a protect rule turns
into an exclude rule if it needs to be sent to an older server.)