[protected-files] Replace with CODEOWNERS

Can the custom action `protected-files` be replaced by `CODEOWNERS`? In principle, I think GitHub tools like `CODEOWNERS` and/or rulesets should be able to enforce this, without requiring a custom action.

Is `protected-files` effectively identical to just adding the bypass group to `CODEOWNERS`, for the files listed in the code?

```pwsh
$protectedFiles = @("cspell.json", "cspell.yaml",
"package.json", "package-lock.json", ".github/*", "eng/*")
$excludedFiles = @(".github/CODEOWNERS")
```

## Partner Dependencies
Another requirement, can we allow partners to merge dependabot PRs, updating their own deps? Like this one?

- https://github.com/Azure/azure-rest-api-specs/pull/39851

## Original

We tried to allow dependabot, then reverted it because it allowed anyone with write access to approve dependabot PRs (we only want to allow engsys).

Can we improve prot-files to allow dependabot and engsys but not anyone with write access?

Could codeowners / rulesets / branch protection in GH settings replace prot-files?