Switches from `protected_branches` to `rulesets`

Similarly to apache/logging-parent#456 this PR switches from GitHub Branch Protection to Rulesets and:

- Keeps the same rules for `main`, while protection `2.x` is **temporarily** disabled in case we need to update the `.asf.yaml` file.
- Adds tag protection for the `rel/*` tags.