Switch to GitHub Rulesets (second attempt) (#477)

* Switch to GitHub Rulesets (second attempt)

The first attempt (#456) had to be reverted in #471 because a bug in ASFYaml made the resulting rulesets impossible to modify or remove through `.asf.yaml`. We rolled back to the legacy `protected_branches` configuration.

apache/infrastructure-asfyaml#93 has now landed and addresses the underlying issues (broken `app_slug` resolution, silent REST API failures, missing `refs/heads/` / `refs/tags/` prefixing), so we can move back to Rulesets.

The benefits over `protected_branches` remain:

- Tag references can also be protected (see the new `rel/*` ruleset).
- A single ruleset can target a glob of refs (e.g. `gha/*`) instead of one branch at a time.
- Rules are publicly visible at https://github.com/apache/logging-parent/rules, so we can verify that the effective rules are those configured and third parties can audit the project's protection policy too.

* fix: use raw syntax for tags

* fix: remove `protected_branches`

No longer needed since apache/infrastructure-asfyaml#121 was merged.

.asf.yaml

diff --git a/.asf.yaml b/.asf.yaml
index 6a6eb53..4e88d2c 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -61,32 +61,55 @@
   features:
     issues: true
 
-  # Prevent force pushes to primary branches
-  protected_branches:
-    main:
+  rulesets:
+    - name: "Branch protection: parent POM"
+      type: branch
+      branches:
+        includes:
+          - "~DEFAULT_BRANCH"
       # All reviews must be addressed before merging
       required_conversation_resolution: true
       # Require checks to pass before merging
       required_status_checks:
-        checks:
-          # The GitHub Actions app: 15368
-          - app_id: 15368
-            context: "build / build (ubuntu-latest)"
-          # The GitHub Advanced Security app: 57789
-          - app_id: 57789
-            context: "CodeQL"
+        # The GitHub Actions app
+        - app_slug: github-actions
+          name: "build / build (ubuntu-latest)"
+        # The GitHub Advanced Security app
+        - app_slug: github-advanced-security
+          name: "CodeQL"
       # At least one positive review must be present
       required_pull_request_reviews:
         required_approving_review_count: 1
-    gha/v0:
+    - name: "Branch protection: reusable actions"
+      type: branch
+      branches:
+        includes:
+          - "gha/*"
       # All reviews must be addressed before merging
       required_conversation_resolution: true
       # Require checks to pass before merging
       required_status_checks:
-        checks:
-          # The GitHub Advanced Security app: 57789
-          - app_id: 57789
-            context: "CodeQL"
+        # The GitHub Advanced Security app
+        - app_slug: github-advanced-security
+          name: "CodeQL"
       # At least one positive review must be present
       required_pull_request_reviews:
         required_approving_review_count: 1
+    # Use raw rules, until a convenience notation for `restrict_update` is introduced.
+    # See: https://github.com/apache/infrastructure-asfyaml/issues/96
+    #
+    # The raw rules need to follow the syntax given in:
+    # https://docs.github.com/en/rest/repos/rules?apiVersion=2026-03-10#update-a-repository-ruleset
+    - name: "Tag protection"
+      target: tag
+      enforcement: active
+      bypass_actors: []
+      conditions:
+        ref_name:
+          include:
+            - "refs/tags/rel/*"
+          exclude: []
+      rules:
+        - type: deletion
+        - type: non_fast_forward
+        - type: update