Use safe-settings or probot/settings to enforce repository policies

### Description
We should implement [github.com/github/safe-settings](https://github.com/github/safe-settings) or [github.com/probot/settings](https://github.com/probot/settings) to enforce the repository policies that current are maintained by hand, like "repo maintainers should also be watchers" and "two approvals are required before a merge".

### Motivation
Automatically enforced policies are preferable (as long as they don't get in the way).

### Exemplification
N/A

### Benefits
Less work setting up a repository, easier to deal with configuration drift, fewer documentation requirements.

### Possible Drawbacks
We can introduce friction if we add policies that we _think_ should apply to all repositories but actually don't. Policy enforcement choices need to be done with care.

Start by reviewing the repository policies currently maintained by hand, especially the watcher and approval requirements. Compare github/safe-settings with probot/settings and decide which policies should be enforced without introducing unwanted friction. Done means the chosen system is configured and the agreed policies are automatically enforced.

Written by the indexing model from the issue text.