Update root-signing branch protections

[haydentherapper]

Limits who can merge to codeowners and keyholders. Also lowered all maintainers to be members of the teams rather than team maintainers.

Summary

Release Note

Documentation

[haydentherapper]

cc @bobcallaway

[github-actions]

🍹 preview on sigstore-github-sync/sigstore/github-prod

Pulumi report

Previewing update (sigstore/github-prod)

View Live: https://app.pulumi.com/sigstore/sigstore-github-sync/github-prod/previews/a1eace94-b020-40a0-96fb-83c597e77614

@ Previewing update.....
pulumi:pulumi:Stack: (same)
[urn=urn:pulumi:github-prod::sigstore-github-sync::pulumi:pulumi:Stack::sigstore-github-sync-github-prod]
~ github:index/teamMembership:TeamMembership: (update)
    [id=4899309:dlorenc]
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/teamMembership:TeamMembership::dlorenc-sigstore-keyholders]
  ~ role: "maintainer" => "member"
+ github:index/teamMembership:TeamMembership: (create)
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/teamMembership:TeamMembership::kommendorkapten-tuf-root-signing-codeowners]
    role      : "member"
    teamId    : "6378909"
    username  : "kommendorkapten"
~ github:index/teamMembership:TeamMembership: (update)
    [id=6378909:dlorenc]
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/teamMembership:TeamMembership::dlorenc-tuf-root-signing-codeowners]
  ~ role: "maintainer" => "member"
@ Previewing update....
~ github:index/branchProtection:BranchProtection: (update)
    [id=BPR_kwDOFotDCM4B9eNe]
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/branchProtection:BranchProtection::root-signing-main]
  ~ pushRestrictions          : [
      + [0]: "T_kwDOBDzYIc4AYVWd"
      + [1]: "MDQ6VGVhbTQ4OTkzMDk="
    ]
  ~ requiredPullRequestReviews: [
      ~ [0]: {
              ~ dismissalRestrictions: [
                  + [0]: "T_kwDOBDzYIc4AYVWd"
                  + [1]: "MDQ6VGVhbTQ4OTkzMDk="
                ]
              ~ restrictDismissals   : false => true
            }
    ]
~ github:index/branchProtection:BranchProtection: (update)
    [id=BPR_kwDOFotDCM4CDLrs]
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/branchProtection:BranchProtection::root-signing-test-ceremony/*]
  ~ pushRestrictions          : [
      + [0]: "T_kwDOBDzYIc4AYVWd"
      + [1]: "MDQ6VGVhbTQ4OTkzMDk="
    ]
  ~ requiredPullRequestReviews: [
      ~ [0]: {
              ~ dismissalRestrictions: [
                  + [0]: "T_kwDOBDzYIc4AYVWd"
                  + [1]: "MDQ6VGVhbTQ4OTkzMDk="
                ]
              ~ restrictDismissals   : false => true
            }
    ]
~ github:index/branchProtection:BranchProtection: (update)
    [id=BPR_kwDOFotDCM4CDLru]
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/branchProtection:BranchProtection::root-signing-ceremony/*]
  ~ pushRestrictions          : [
      + [0]: "T_kwDOBDzYIc4AYVWd"
      + [1]: "MDQ6VGVhbTQ4OTkzMDk="
    ]
  ~ requiredPullRequestReviews: [
      ~ [0]: {
              ~ dismissalRestrictions: [
                  + [0]: "T_kwDOBDzYIc4AYVWd"
                  + [1]: "MDQ6VGVhbTQ4OTkzMDk="
                ]
              ~ restrictDismissals   : false => true
            }
    ]
- github:index/repositoryCollaborator:RepositoryCollaborator: (delete)
    [id=root-signing:kommendorkapten]
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/repositoryCollaborator:RepositoryCollaborator::root-signing-kommendorkapten]
    permission               : "maintain"
    permissionDiffSuppression: false
    repository               : "root-signing"
    username                 : "kommendorkapten"
- github:index/repositoryCollaborator:RepositoryCollaborator: (delete)
    [id=root-signing:haydentherapper]
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/repositoryCollaborator:RepositoryCollaborator::root-signing-haydentherapper]
    permission               : "maintain"
    permissionDiffSuppression: false
    repository               : "root-signing"
    username                 : "haydentherapper"
Resources:
+ 1 to create
~ 5 to update
- 2 to delete
8 changes. 571 unchanged