Automate rejecting commits without a DCO sign-off

The repo could use automated verification of sign-offs on every new commit.

My suggestion:

- Enable GH repo setting `General > Commits > Require contributors to sign off on web-based commits`
- Install GH app (like [DCO](https://github.com/apps/dco) or [DCO-2](https://github.com/apps/dco-2)) or enable CI action that checks DCO sign-off
- Enable the DCO checks under `Branch Rules > Require status checks to pass` for a ruleset targeting the protected (all?) branches

Start in GitHub repository settings under General > Commits and review the Branch Rules or ruleset configuration for protected branches. Compare the DCO and DCO-2 apps with a CI action, then verify which DCO status checks can be required. Done means new commits without sign-off are rejected or blocked on the targeted branches, while signed commits pass.

Written by the indexing model from the issue text.