Branch protection on main not adhering to best practices

Nobody has claimed this yet.

:wave: Hey there! It's [Changebot](https://github.com/mapbox/changebot), and I help repositories follow our [engineering](https://github.com/mapbox/engineering) best practices. My magic wand found some things I wanted to highlight for your review:

Item | Current status | Best practice guidelines
--- | --- | ---
main branch protection: Dismiss stale pull request approvals when new commits are pushed | Unchecked | Checked
main branch protection: Require review from Code Owners | Unchecked | Checked
main branch protection: Restrict who can dismiss pull request reviews | Unchecked | Checked
main branch protection: Require branches to be up to date before merging | Unchecked | Checked
main branch protection: Restrict who can push to this branch | Unchecked | Checked

Can you take a look at these best practices and make any adjustments if needed?

Please tag `@mapbox/security-and-compliance` on this issue if you have any questions

No source files or tests are mentioned. Start in the repository's GitHub branch protection settings for main and compare the five unchecked controls with the linked engineering best-practice guidance; done means the applicable controls are enabled or the required exceptions are documented, with security-and-compliance consulted if needed.

Written by the indexing model from the issue text.