Protect `master` branch to prevent accidents

[jeffwidman]

I saw this on the home page:

I assume this was an accidental oversight... Or is there a reason this isn't currently enabled?

On other projects I help maintain, typically we setup the following:

1. master is locked against pushes by everyone, only merge via PR.
2. PR's require at least 1 review
3. Most CI checks are made mandatory... the exception is stuff like code coverage bots, which sometimes it's okay if code coverage drops slightly during a refactor etc.

[jeffwidman]

It just felt unsafe to me that as soon as :dependabot: opened https://github.com/FactoryBoy/factory_boy/pull/1074, I could have immediately merged it. So for now I defaulted to safety and enabled a branch protection including mandatory CI checks, 1 PR approval, and no force-pushing.

No problem if we want to turn this off, but defaulting to safety seemed best for now.