chore: migrate branch protection to rulesets

[shreemaan-abhishek]

Description

OpenSSF Scorecard currently reports the repository's Branch-Protection check as unknown because protected_branches is materialized as classic GitHub branch protection, which the scanner's low-privilege token cannot inspect.

This PR migrates that policy to an ASF-managed GitHub repository ruleset. The intent is to keep branch protection declarative in .asf.yaml while making the effective rules visible to OpenSSF Scorecard.

The ruleset:

• covers master and every current or future release/* branch, avoiding the maintenance gap caused by enumerating release branches;
• blocks branch deletion and force pushes;
• requires code-owner review and three approvals; and
• dismisses stale reviews after new pushes.

This intentionally standardizes release branches on the same three-approval and stale-review policy as master; some older release branches previously required two approvals without stale-review dismissal.

References:

• Current Scorecard result: https://securityscorecards.dev/viewer/?uri=github.com/apache/apisix
• ASF ruleset configuration: https://github.com/apache/infrastructure-asfyaml#rulesets

Which issue(s) this PR fixes:

N/A

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)

Validation: asfyaml-validate --repo .