[6.x] Add codeowners and tripwire

[jasonvarga]

This is an internal tooling PR.

• Adds a CODEOWNERS file that'll trigger PR review requests when certain sensitive files are modified.
• Adds a tripwire workflow that'll raise a red flag if composer.json's autoloaded files array changes (as per laravel-lang supply chain attack.) It's mainly to prevent something accidentally slipping through a review. It itself does not increase security.