Use bot PAT for auto-merge approvals and require code owner reviews

[ydesgagn]

Summary

Switches the auto-merge approval workflow to use a bot Personal Access Token instead of the default GITHUB_TOKEN, transfers ownership from an individual to the Cloud-Officer/maintainers team in CODEOWNERS, and enables require_code_owner_reviews on protected branches so code owner approval is enforced.

Key changes:

• Update .github/CODEOWNERS to assign ownership to @Cloud-Officer/maintainers (team) instead of @ydesgagn.
• Update .github/workflows/auto-merge.yml to authenticate the approve step with secrets.GH_BOT_PAT instead of secrets.GITHUB_TOKEN.
• Update lib/ghb/auto_merge_manager.rb to generate the auto-merge workflow with the new GH_BOT_PAT secret.
• Update lib/ghb/repository_configurator.rb to set require_code_owner_reviews: true on protected branches.
• Update spec/ghb/auto_merge_manager_spec.rb to assert the approve step uses secrets.GH_BOT_PAT.

Types of changes

• Bugfix (fixes an issue)
• New feature (adds functionality)
• Refactoring (improves code without changing functionality)
• Breaking change (incompatible changes)
• Build or security update (updates dependencies, libraries, or security patches)
• Code style or documentation update (formatting, renaming, or documentation changes)
• Other (please describe):

Checklist

• Unit tests added to validate my fix/feature
• I have manually tested my change
• I did not add automation test. Why ?:
• Database changes requiring migration with downtime or reprocessing of existing data
• The SOUP file lists the risk Level, requirements and verification reasoning associated with each library
• readme.md includes sections on introduction, installation, usage, and contributing
• docs/architecture.md includes sections on the architecture diagram, software units, software of unknown provenance, critical algorithms and risk controls related to PII and security
• Impact on PII, privacy regulations (CCPA/GDPR/PIPEDA), CIS benchmarks or security (availability/confidentiality/integrity); management must be notified