Require a maintainer's approval to merge

The repository inherits a collaborator list from the organisation, so about a
dozen people can push and, with no review required, merge their own work. That
is the wrong default for a public repository.

Name the owners explicitly so the protection rule on main has somebody to
demand an approval from.

Author: davidmckayv

.github/CODEOWNERS

@@ -0,0 +1,12 @@
+# Who has to approve a change before it can reach main.
+#
+# This repository is public, and its collaborator list is inherited from the
+# organisation, so a great many people can open and push branches. Merging is
+# deliberately narrower: the branch protection rule on `main` requires an
+# approving review from an owner listed here, and it applies to administrators
+# too, so there is no path that lands a change without one.
+#
+# Widening this list widens who can approve. Add people who know the codebase
+# well enough to say no.
+
+*  @davidmckayv @guidovizoso