Issue #3611564: Make ExpireHolds injected services protected so the queue worker survives serialization

ExpireHolds implements ContainerFactoryPluginInterface (uses DependencySerializationTrait) but declared its injected services as promoted private readonly properties, which the trait cannot restore after a queued item is serialised and resumed. PHPStan reported four dependencySerializationTraitProperty errors. Makes both promoted properties protected and drops readonly.