Setup github branch protection to verify required tags

[marmarek]

How to file a helpful issue

The problem you're addressing (if any)

Github doesn't enforce our signed tags requirements, it's enforced only later at package fetch time by qubes-builderv2. This means, a maintainer can push to a branch forgetting a tag, and may not spot the mistake until somebody notices qubes-builderv2 fails to fetch it.

The solution you'd like

Add branch protection rules in github that enforce the check. This way, the push will be blocked if required tag(s) is missing. This will be even more relevant when requiring tags from multiple maintainers (see #7739).

Note it does not move signature check to github, it's just a hint to detect missing tags earlier.

Note, technically it will require pushing tags and commits to some branch before pushing to main/release. But it is already the case for many repositories - changes are pushed to "main-staging" branch and there is a bot moving it to "main" only after CI completes. This change proposes to kinda extend the CI check to verify the tag(s) too.

The value to a user, and who that user might be

This is mostly for maintainers to have better feedback from CI. As a side effect, this should also block the "merge" button on pull request web interface.

Completion criteria checklist

(This section is for developer use only. Please do not modify it.)

• Add a bot that calls qubes-builderv2 package fetch and reports result as github commit status
• Make the status check required on main/release branches