Start requiring an approving review for mergers

[MangoIV]

I think it would be good if we required an approving review before merging something, this is good practise for several reasons and should be clear.

[blackheaven]

We have no formal process, currently, whenever someone of the HSRT review a PR, (s)he can then merge it, without any particular deadline.

[MangoIV]

I think it would be good practice to always (or at least in the default case) require an approving review; even if the PR was raised by a team member, that way we make sure that the code has high quality and people really looked over the entire PR; especially to try and stay on-topic, two pairs of eyes always see more than one pair. ;)

[blackheaven]

I agree, for the record, aside of #168 which was approved on our internal ML, I only did it for CI related problems #172 #173 #174, which hard quite hard to debug on other repositories.

[frasertweedale]

I'm fine with Gautier self-merging CI-related changes :) But yeah, for library and executable code, and advisories, for sure, we should require reviews.