[Security] Strengthen branch protection rules

## Issue
OpenSSF Scorecard identified that branch protection is not maximal on development and release branches, scoring 5/10.

## Risk Level
**High** - Inadequate branch protection can allow unauthorized or unreviewed code to reach production.

## Current State
- Some branch protection rules are in place (5/10 score)
- Protection settings not maximal across all protected branches
- Gaps in enforcement could allow policy bypass

## Recommendation
Strengthen branch protection on `main` and release branches:

### Required Settings:
- ✅ Require pull request reviews before merging
- ✅ Require approvals (at least 1-2 reviewers)
- ✅ Dismiss stale pull request approvals when new commits are pushed
- ✅ Require review from Code Owners (if CODEOWNERS file exists)
- ✅ Require status checks to pass before merging
- ✅ Require branches to be up to date before merging
- ✅ Require conversation resolution before merging

### Optional (Recommended):
- Consider requiring signed commits
- Restrict who can push to matching branches
- Require linear history

## Steps to Implement
1. Navigate to repository Settings → Branches → Branch protection rules
2. Edit protection rules for `main` branch
3. Enable recommended settings listed above
4. Apply same rules to any release branches
5. Test with a test PR to ensure rules work as expected

## References
- [OpenSSF Scorecard - Branch Protection](https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection)
- [GitHub Branch Protection Documentation](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches)
- OpenSSF Scorecard Score: 5/10

## Related
Part of OpenSSF Scorecard evaluation THEEDGE-4717 (overall score: 6.8/10)