What is the difference between the SPI and I²C protocols
SPI is a 4-wire signalling scheme with a single bus master and several slaves. There's a chip select signal (CS, or slave select SS) dedicated clock signal (SCK) and two data signals, one for reception (MISO = Master In ← Slave Out), one for transmission (MOSI = Master Out → Slave In).
Transmission starts by asserting (= pulling low) SS, then for each bit MISO and MOSI are set after a SCK high→low transition and the actual transfer happens on a SCK low→high transition. Beyond that, there's no such thing as a "standard protocol" carried over SPI beyond the transmission of groups of bits; every component with an SPI interface may define its own.
I²C is a 2-wire signalling scheme, capable of multiple bus masters. It's a lot more complex than SPI, so I suggest you read the Wikipedia article about it.
used to program a microcontroller?
No, because that depends on the microcontroller you're using. Also do you want to write a program for that microcontroller that does communication over SPI or I²C? If this is the case I can give you no answer, because it depends on the controller you're using. It usually boils down to configuring the SPI peripheral (if it got one) or implementing the bit-banging on the GPIOs (which again is specific to the microcontroller used) yourself.
Or do you actually want to program the microcontroller flash over this? If the later is the case take note that the actual programming method depends on the actual microcontroller used and may not happen over SPI at all. And I know of no microcontroller that actually uses I²C for flash programming (except if it has been programmed with a bootloader that does the talking).
SPI is used for programming the Atmel ATMega microcontrollers. But the XMega microcontrollers are programmed using an interface called PDI, which is a completely different beast (uses the reset pin for clock and as a dedicated PDI Data pin).
Most ARM microcontrollers are programmed using JTAG. Then there are interfaces like SWI (which is related to, but not the same as JTAG).