Make Location.alt private to make altitude datums explicit

[Ryanf55]

          > What we really need to do is change to using an alt_frame attribute on Location instead of using these booleans.

Yes, we do, I've had patches around it before.

There some subtleties around the terrain stuff in particularly - there's some weird persistence with terrain following which you have to be really careful around.

Nothing impossible, of course, but terrain is unforgiving :-)

The trick is to make `.alt` private in Location and fix what breaks.

Originally posted by @peterbarker in https://github.com/ArduPilot/ardupilot/issues/28406#issuecomment-2416165852

Let's make the alt member of the Location structure private. After spending about 2 hours converting to getters/setters on https://github.com/Ryanf55/ardupilot/tree/private-alt-in-location, I have some ideas:

We frequently subtract/add altitudes from location structures. They are usually in the same datum. Perhaps we can find a way to save on comparisons and still shortcut when they are the same frame if we make an AP_Location::Altitude class that carries the altitude value, has the frame, and supports operators such as -, +, +=, -=.

Thoughts on the approach I've taken so far of adding a getter with no frame? The getter could be a workaround as we phase reading .alt in the codebase.