Require approval to run GH Actions for every PR by outside collaborator

[hannes-ucsc]

It looks like we're only requiring approval for first-time outside contributors. That would mean that once a first PR was approved, subsequent PRs would not. I want to tighten that and require approval for every PR from an outside contributor, not just the first one.

https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks

Originally posted by @hannes-ucsc in https://github.com/DataBiosphere/azul/issues/4012#issuecomment-1089299018

We need to do this for every repository we maintain.

[hannes-ucsc]

I inventoried all of our repositories and tagged them with the boardwalk topic so we can easily filter them:

• https://github.com/orgs/DataBiosphere/repositories?q=boardwalk&type=all&language=&sort=name
• https://github.com/HumanCellAtlas?q=boardwalk&type=all&language=&sort=name

Currently this gives

• [x] https://github.com/DataBiosphere/azul/settings/actions
• [x] https://github.com/DataBiosphere/azul-chalice/settings/actions
• [x] https://github.com/DataBiosphere/azul-github-labeler-action/settings/actions
• [x] https://github.com/DataBiosphere/azul-tinyquery/settings/actions
• [x] https://github.com/DataBiosphere/cellxgene-fargate/settings/actions (archived)
• [x] https://github.com/DataBiosphere/data-portal/settings/actions
• [x] https://github.com/DataBiosphere/hca-import-validation/settings/actions
• [x] https://github.com/DataBiosphere/hca-metadata-api/settings/actions
• [x] https://github.com/DataBiosphere/sync-github-labels/settings/actions
• [x] https://github.com/HumanCellAtlas/azul-github-labeler-action/settings/actions (archived)
• [x] https://github.com/HumanCellAtlas/dcp2/settings/actions

The check boxes track my progress adjusting the permissions.