ci: Enable crates.io auto-release, but require certain people to appr…

…ove the PRs (#1069)

This setups a restricted ownership over the changelog files, so the
release PRs by `release-please` or `release-plz` have to be approved by
a restricted set of people.

We can then enable auto-releases for rust (for python is already
enabled).

Feel free to suggest other users to add to the list.

.github/CODEOWNERS

@@ -5,3 +5,8 @@
 
 # Add specific rules below.
 # Lower the rule, higher the precedence
+
+# The release PRs that trigger publication to crates.io or PyPI always modify the changelog.
+# We require those PRs to be approved by someone with release permissions.
+hugr/CHANGELOG.md @aborgna-q @ss2165
+hugr-py/CHANGELOG.md @aborgna-q @ss2165

.github/workflows/release-plz.yml

@@ -23,7 +23,6 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
       - name: Run release-plz
         uses: MarcoIeni/[email protected]
-        with:
-          command: release-pr
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}