Move branch protection rules to rulesets

[terrytangyuan]

Rulesets are publicly visible, which is good for transparency, and required for OpenSSF checks to not need a PAT. This should bump that subscore from -1 to 10. Otherwise the rules should work the same, just moved to a newer GH feature

[agilgur5]

Noting that this is from today's Contributor Meeting, quoted from me and will resolve #12031 "Branch Protection". (I do not have permissions to do this, which is why I brought it up)

Here's also a link to the docs for GH rulesets