feat: expose Protocol and Metadata as opaque FFI handle types (delta-io#2260)

## What changes are proposed in this pull request?

Adds `SharedProtocol` and `SharedMetadata` as first-class opaque FFI
handle types, giving
FFI callers structured access to snapshot protocol and metadata fields.

Previously there was no way for FFI callers to access protocol versions,
table features, or
core metadata fields (id, name, description, format provider, created
time). This PR adds
the full surface via two new handle types and visitor-based accessors.

**New FFI functions:**

- `snapshot_get_protocol` / `free_protocol` -- acquire and release a
protocol handle
- `visit_protocol(handle, ctx, visit_versions, visit_feature)` --
single-call visitor that
reports `(minReaderVersion, minWriterVersion)` and iterates
reader/writer feature names
  (skipped for legacy protocols)
- `snapshot_get_metadata` / `free_metadata` -- acquire and release a
metadata handle
- `visit_metadata(handle, allocate_fn, ctx, visitor)` -- single-call
visitor that reports
id, name, description, format provider, and created time (strings
allocated via caller's
  `allocate_fn`)

**Kernel change:**

Adds `Metadata::format_provider() -> &str` (gated behind
`#[internal_api]`) since
`Metadata.format` is a private field with no existing accessor.

## How was this change tested?

4 new `#[tokio::test]` cases in `ffi/src/lib.rs`:
- `test_visit_protocol_legacy` -- legacy protocol (minRV=1, minWV=2):
verifies versions,
  confirms feature visitor is never called
- `test_visit_protocol_with_features` -- modern protocol (minRV=3,
minWV=7) with
columnMapping + rowTracking: verifies both reader and writer feature
callbacks
- `test_visit_metadata_default` -- default metadata: id, null
name/description, format
  provider, createdTime
- `test_visit_metadata_with_name` -- metadata with name set: id, name,
createdTime

Author: chiinlquah