Also make the root group pseudo static, i.e. it shouldn't be changed after the database has been fully constructed.
This hopefully completes support for reading/writing kdbx <= 2.14 files. Also fix a bug in KeePass2XmlWriter so it sets Protected="True" in the Value tag instead of Key.