Allow protect to be set dynamically

[jamest-pin]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

• Similar to https://github.com/pulumi/pulumi-yaml/pull/510
• see also https://github.com/pulumi/pulumi-yaml/issues/453

I want to set protect: dynamically. Something like this.

# Pulumi.develop.yaml
config:
  varProtectDBs: false

# Pulumi.production.yaml
config:
  varProtectDbs: true

# Pulumi.yaml
resources:
  myDBresource:
    options:
      protect: ${pulumi.stack}.${varProtectDBs}
    [...]

Why? In dev environment, I don't care if some resources get destroyed or recreated. In other environments that may have data populated, such as UAT or Prod, I want to set them protected. Best practice is to set per environment values in the stack config file. I'm currently unable to do this because protect: appears to only accept a literal boolean, not an interpolated value. See my comment and the following @Frassle 's comment in #453

Affected area/feature