migrate-repo creates classic branch protection rules instead of Branch Rulesets

## Description

When `gh ado2gh migrate-repo` migrates branch policies from Azure DevOps, it creates **classic branch protection rules** on the target GitHub repository. GitHub now recommends **Branch Rulesets** as the successor to classic rules, offering organization-wide reuse, stacking, and richer conditions.

## Expected behavior

`ado2gh` should create Branch Rulesets (or provide a flag like `--use-rulesets`) instead of classic rules when migrating ADO branch policies.

## Impact

Teams migrating from ADO to GitHub land on a legacy protection mechanism and must manually convert rules to Rulesets post-migration.