Change protected repo option to selection

[anbraten]

It could be quite helpful to change the protected option to be a selection with three options:

• not protected: run pipelines directly (same as currently disabled protection)
• protect against forks: if a pipeline from a PR of a fork is started wait for approval
• completely protected: always ask for approval

Maybe we should also think about renaming the option to something like: trust level, ...

[qwerty287]

Maybe we could add some more complex options here:

• first time contributors: require approval for users contributing the first time
• once per PR: once a PR is approved once, allow any new commit to run without approval
• for non-maintainers: allow for users which are maintainers of a repo to run without approval (i.e. users that have write access)
• for non-admins: as for non-maintainers, but only allow admins
• on non-default branch: if the commit was not made on the default branch

[gapodo]

Found this when checking before opening a FR, another nice option would be to be able to allow based on event. In combination with the above would be huge, but event allowing to set protected while still auto running tags (as their protection can come from the forge) would be nice.

• based on event allow <selection of events> but protect the rest