re-enable branch protection

[colemickens]

Steps:

1. Enroll a PAT for colebot.
2. Add that as a secret here.
3. Use that PAT to push instead of the default GITHUB_TOKEN auth.

This should make the push happen as colebot.

The rule can be given a bypass allowance for Maintainer role, which colebot has.

This will make sure PRs are green, while allowing colebot to manually push update commits.