Make setUp() and tearDown() protected

The proper signature used to be "function setUp()", then it was changed to "public function setUp()", and now apparently we're supposed to be using "protected function setUp()". I can't find any change notices or documentation which says this, and the example code on drupal.org still shows public, but most of core was changed to protected last year in #2322889: Various setUp() and tearDown() methods are not protected. So let's do this for Ubercart as well.