This change adds support for protected members in classes as proposed in #1. Also, this change introduces better error messages for assignability and subtype checks involving private and optional properties.

Protected members are modeled after C# and Java. Protected members can be accessed only within the declaring class and subclasses of the declaring class. Furthermore, access to a protected instance member is required to take place through an instance of the enclosing class type or a class type constructed from it (this prevents "sibling" class access).

Protected members can be made public in derived classes. Similar to private members, constructors and signature members cannot be protected.

I will follow up with a more formal specification of the rules but wanted to put up the code for folks to experiment with.

Update: Formal specification provided in #700.