Add a gittuf policy

[jeffmendoza]

Allstar could run gittuf across all repos in an org and alert any repos which gittuf does not pass.

cc @adityasaky I saw your presentation at the TAC meeting today, looks like a good fit!

[adityasaky]

I'm taking a closer look at Allstar, to understand how the two projects can complement each other. Thanks for pointing me to this!