Branch protection may live in rulesets, not classic protection

When checking whether a GitHub branch requires code owner review, gh api repos/OWNER/REPO/branches/main/protection can return 404 'Branch not protected' even though the branch is protected by a repository ruleset. Also query gh api repos/OWNER/REPO/rulesets and then rulesets/<id> to see pull_request rule params like require_code_owner_review and required_approving_review_count. Also note: if required approvals equals the number of code owners, a PR authored by one code owner needs an extra non-owner approver.