CI/CD - Configure required approvals for new contributors

[bcheidemann]

By default, all first-time contributors require approval to run workflows.

See https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks

No work to be done here.