policy, control, web, wiki: require-mr makes protected branches merge-only !339

repo settings require-mr <owner/name> on|off: with it on, an existing protected branch refuses every direct push in pre-receive, repo commit-file and the web editor are refused the same way, and mr merge is the only writer. Creating the branch is still a push. Settings page checkbox, settings show field, Users page paragraph. Policy unit cases and an e2e that pushes, is refused, and lands the change through a merge request.

Closes #197