feat!: generic rulesets interface with presets (org + per-repo)

[josmo]

What

Replaces the two bespoke org-ruleset knobs (baseline_ruleset,
require_signed_commits) with a single generic ruleset interface reused at
the organization and per-repository level, plus opt-in presets that are the
opinionated starting points. Default presets reproduce today's behavior, so
existing configs see no functional change beyond the input migration.

Added

• Org: organization_rulesets (generic map) + enabled_presets. Presets:
  require_pull_request_reviews, restrict_deletions, require_signed_commits,
  block_force_pushes, require_linear_history. A custom organization_rulesets
  entry overrides a preset of the same name.
• Per-repo: rulesets on the repositories object → github_repository_ruleset,
  scoped to the repo, with team-name bypass resolution.
• Generic bypass_actors — { actor_type, actor_id, bypass_mode } (plus a
  per-repo team name convenience); OrganizationAdmin coerced to actor_id 1.
• Validations for enforcement, target, bypass actor_type/bypass_mode
  at both levels; per-repo team-existence + team-bypass checks.

Breaking change

baseline_ruleset and require_signed_commits are removed.

# before                                                                                                                                                                                                          
baseline_ruleset       = { required_approving_review_count = 2 }                                                                                                                                                  
require_signed_commits  = true                                                                                                                                                                                    
# after — presets (defaults shown) + override the PR preset for 2 approvals                                                                                                                                       
enabled_presets = ["require_pull_request_reviews", "restrict_deletions", "require_signed_commits"]                                                                                                                
organization_rulesets = {                                                                                                                                                                                         
  require_pull_request_reviews = {                                                                                                                                                                                
    include_refs  = ["~DEFAULT_BRANCH"]                                                                                                                                                                           
    bypass_actors = [{ actor_type = "OrganizationAdmin" }]                                                                                                                                                        
    rules = { pull_request = { required_approving_review_count = 2, require_code_owner_review = true, required_review_thread_resolution = true } }                                                                
  }                                                                                                                                                                                                               
}                                                                                                                                                                                                                 
The single old "Baseline" ruleset now splits into two granular rulesets — functionally identical (rulesets compose). The signed_commits = false per-repo opt-out is preserved (feeds the require_signed_commits   
preset's exclusions).