RFC Enabling auto-merge builtin Github functionality

The main advantage would be to be able to say on a per-PR basis "this PR can be merged when CI is green". See the [doc](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request) for more details. cc @scikit-learn/core-devs @scikit-learn/contributor-experience-team for visibility.

Currently we need to remember to come back in one hour and we sometimes forget. As a maintainer with many different things to track, it would be very nice to have this sense of quicker completion and the peace of mind of not having to remember to come back to merge the PR.

Here is a screenshot from sphinx-gallery which has set this up:
![image](https://user-images.githubusercontent.com/1680079/204514285-836bca8f-163e-4f07-9a84-b13441b8ee6d.png)

You can see this is a per-PR thing ("Enable automerge" button) and there is even a way to bypass branch protection, which can be nice in some rare cases (for example we know for a fact that the CI error is not related to the PR).

Things we would need to do:
- [ ] set-up branch [branch protection rules](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule)
  + [ ] define required checks: probably azure + github doc build, maybe others. We probably want to leave aside other more noisy checks like codecov?
  + [ ] require 1 approval rather than 2 (to allow DOC PRs to be merged with only one approval)
- [ ] set-up [auto-merge](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-auto-merge-for-pull-requests-in-your-repository)
  + [ ] make sure we check the require required checks (Thomas' comment at the meeting)
  + [ ] reset auto-merge when a commit is pushed after auto-merge is set, just to be on the safe side. This [link](https://github.blog/changelog/2021-03-22-updated-pull-request-auto-merge-behavior-for-users-without-write-access/) says that it is done automatically, unclear whether this is the same thing as "Dismiss stale pull request approvals when new commits are pushed" setting in branch protection rules.

Other items from discussions at the meeting:
- Q: does a human have to click "auto merge" on a PR for it to happen, or does it automatically happen for all PRs that match the approval requirements?
- A: a per PR manual action is required to allow automerge, see screenshot above
- Q: is "merge when CI is green" functionality of "[Refined GitHub](https://github.com/refined-github/refined-github)" a solution?
- A: you need to keep the tab open for it to work, and in my limited experience it does not work reliably. Also it is not public information that the PR will be merged when CI is green.

COMMENT:
> define required checks: probably azure + github doc build, maybe others. We probably want to leave aside other more noisy checks like codecov?

I agree. Looking at the UX for "Require status checks to pass before merging", it requires us to list out the checks. I think this means we need to revisit the rules whenever we update add or rename a CI job. This is a little bit more maintenance for us.

> require 1 approval rather than 2 (to allow DOC PRs to be merged with only one approval)

For this, we need to enable "Require a pull request before merging", which works for `main`. For release branches, we sometimes push directly to `1.X` to trigger wheel builds. (The GitHub wheel build can be trigger with a "workflow_run", but the Travis ARM wheels needs a commit.)

From the UX for "Do not allow bypassing the above settings":

> The above settings will apply to administrators and custom roles with the "bypass branch protections" permission.

If we allow for bypassing branch protections, does that mean **only** the "Admin" role can bypass it? If so, I am okay with allowing for bypassing branch protections and setting up auto-merge.

Labels: RFC