Request: Add branch protection rules to prevent issues like #81

Please refer to #81

This issue demonstrates a problem with our current CI workflow.
Multiple PRs were created, and each PR passed tests individually when they were opened.
However, our test pipeline only checks each PR in isolation and does not verify compatibility when multiple PRs are merged together.
As a result, both PRs were merged based on their individual test results, but this caused an issue in the main branch.

The key question is: why didn't our test pipeline catch this?
The reason is when the pipeline runs.

By default, the test pipeline runs when the PR is created.
After that, the pipeline doesn't run again at all.

In this situation, if there are multiple PRs, the issue may occur.

For example, think about a scenario where there are two PRs that are reviewed and merged at the same time.
Once PR1 is merged, the target branch code is modified. But at this moment, PR2 was already created, so the test pipeline is not triggered again.
The pipeline that ran when PR2 was created only tested PR2 in isolation. This mechanism can't catch conflicts between PR1 and PR2.

This is exactly what happened in our case.

I created four PRs to implement pytest for each submodule. Each test was correct individually.
However, there were conflicts between them, and our test pipeline couldn't catch this because it only tests PRs in isolation.

I've investigated a workaround for this issue, and I found that we can set "branch ruleset" to prevent this.
I've created another document that shows how to configure "branch ruleset".
Please check it and configure it for the alma-sbom repository: https://hackmd.io/@KAWAHARAsouta/BkovBXZ8-l