Strengthen branch protections

[gdalle]

I accidentally pushed to main directly for b7ba287 and the repo didn't stop me. Perhaps we should add rules so that such pushes are impossible, even for people with the necessary permissions? There is one to require pull requests but we may need to tick the box that says it applies to all roles.