do not downgrade protected chats over the wire

downgrading is possible only for oneself,
not for the whole group.

enabling is still done for all as a "best effort".

this gives the user who enabled protection
strong guarantess about ones state.

downside may be different views on a chat by different users,
however, that could also happen before.

src/dc_receive_imf.rs

@@ -955,10 +955,10 @@ async fn add_parts(
                 warn!(context, "verification problem: {}", err);
                 let s = format!("{}. See 'Info' for more details", err);
                 mime_parser.repl_msg_by_error(s);
-            } else {
-                // change chat protection only when verification check passes
-                if let Some(new_status) = new_status {
-                    if chat_id
+            } else if let Some(new_status) = new_status {
+                if !chat.is_protected()
+                    && new_status == ProtectionStatus::Protected
+                    && chat_id
                         .update_timestamp(
                             context,
                             Param::ProtectionSettingsTimestamp,
@@ -966,7 +966,13 @@ async fn add_parts(
                         )
                         .await?
                 {
-                        if let Err(e) = chat_id.inner_set_protection(context, new_status).await {
+                    // Upgrade chat to a protected chat.
+                    // As this gives some guarantees to the user,
+                    // we do not allow downgrades over the wire.
+                    if let Err(e) = chat_id
+                        .inner_set_protection(context, ProtectionStatus::Protected)
+                        .await
+                    {
                         chat::add_info_msg(
                             context,
                             chat_id,
@@ -986,7 +992,6 @@ async fn add_parts(
             }
         }
     }
-    }
 
     // Ensure replies to messages are sorted after the parent message.
     //