Add branch protections and merge restrictions

[radu-matei]

Here is a snapshot of the current branch protections:

• the protections only apply to the master branch - and they should probably also apply to release branches.
• we should require review from code owners - in practice this already happens
• we should also require administrators to follow the same restrictions
• LE: ~we should mark the spec validation check to be required~ - as @vdice points out, this is already happening.

Thoughts?

[vdice]

we should mark the spec validation check to be required

Quick note here: validation and cnab-spec-validate are actually the same check. The former is the current name, the latter is the new name if/when the following PR is merged: https://github.com/cnabio/cnab-spec/pull/350 (So, there will ultimately only be one spec validation target. But agreed, it should remain required.)

[carolynvs]

Yeah we use a much more locked down set of perms on Porter's repositories because people who are not maintainers have admin rights on the organization. So this is a really good idea. 👍

Another thing we have turned on is Restrict who can push to matching branches which prevents accidental pushes directly to a branch without a pull request.

[carolynvs]

I have updated cnab-spec and cnab-go with our desired changes.