[core-workflow] Block direct pushes to the cpython repo?

I opened https://github.com/python/core-workflow/issues/16 to track the idea of turning off direct pushes to the git repo after the migration at some point. But immediately both Senthil and Barry voted to say they thought we should just start off on the proper footing and just block direct pushes to begin with. If you have a +1/-1 reaction to this then please add the appropriate reaction to https://github.com/python/core-workflow/issues/16#issue-205987825 (i.e. add a thumbs up or down reaction depending on how you care to vote). If things obviously lean in one way or the other will help me decide how we want to start the repo set as (we can obviously turn it off if it turns out to be a problem).