Use branch protection features?

[mr-tz]

I'd enable at least 1 and maybe 2.

[williballenthin]

[williballenthin]

done

[mr-tz]

disabling partly again for now because this causes issues with capa-rules sync

https://github.com/mandiant/capa-rules/runs/7191597426?check_suite_focus=true

remote: error: GH006: Protected branch update failed for refs/heads/master.        
remote: error: 3 of 3 required status checks are expected. At least 1 approving review is required by reviewers with write access.        
To https://github.com/mandiant/capa.git
 ! [remote rejected] HEAD -> master (protected branch hook declined)
error: failed to push some refs to 'https://github.com/mandiant/capa.git'