merge gates: CODEOWNERS is a setting, not a file that happens to exist !228

Stacked on !227.

CODEOWNERS gated as soon as the file existed. Every other merge requirement is something an admin turned on, so require_codeowners joins them: repo settings require-codeowners <owner/name> on|off and a checkbox on the settings page. Off by default, and still independent of require_approvals (#99).

With the toggle on and no CODEOWNERS file on the target branch, the merge is refused and names the branch, rather than a gate that enforces nothing.

Existing repositories carrying a CODEOWNERS file lose the gate until the toggle is set — nothing back-fills it, since the database alone cannot say which branches have the file.

Closes #142