Lock down looker-hub main from accepting PRs with custom changes (except from dataops-looker)

[scholtzan]

We had a couple of instances were PRs with manual changes got opened against looker-hubs main branch and then got merged causing lookml-generator to error out since the pushed files did not match the generated files. Generally, manual changes should be done in spoke-default or spoke-private projects.

It would be good to prevent custom PRs from getting opened against looker-hubs main branch. This way they can't get accidentally merged.
We still want the dataops-looker user to open PRs against it, and possibly admins (or maybe no one?). It should also still be possible for users to create new branches in the project to allow for testing changes.