Switch to GitHub Rulesets (second attempt) (#477)

* Switch to GitHub Rulesets (second attempt)

The first attempt (#456) had to be reverted in #471 because a bug in ASFYaml made the resulting rulesets impossible to modify or remove through `.asf.yaml`. We rolled back to the legacy `protected_branches` configuration.

apache/infrastructure-asfyaml#93 has now landed and addresses the underlying issues (broken `app_slug` resolution, silent REST API failures, missing `refs/heads/` / `refs/tags/` prefixing), so we can move back to Rulesets.

The benefits over `protected_branches` remain:

- Tag references can also be protected (see the new `rel/*` ruleset).
- A single ruleset can target a glob of refs (e.g. `gha/*`) instead of one branch at a time.
- Rules are publicly visible at https://github.com/apache/logging-parent/rules, so we can verify that the effective rules are those configured and third parties can audit the project's protection policy too.

* fix: use raw syntax for tags

* fix: remove `protected_branches`

No longer needed since apache/infrastructure-asfyaml#121 was merged.