RFC Enabling auto-merge builtin Github functionality

The main advantage would be to be able to say on a per-PR basis "this PR can be merged when CI is green". See the [doc](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request) for more details. cc @scikit-learn/core-devs @scikit-learn/contributor-experience-team for visibility.

Currently we need to remember to come back in one hour and we sometimes forget. As a maintainer with many different things to track, it would be very nice to have this sense of quicker completion and the peace of mind of not having to remember to come back to merge the PR.

Here is a screenshot from sphinx-gallery which has set this up:
![image](https://user-images.githubusercontent.com/1680079/204514285-836bca8f-163e-4f07-9a84-b13441b8ee6d.png)

You can see this is a per-PR thing ("Enable automerge" button) and there is even a way to bypass branch protection, which can be nice in some rare cases (for example we know for a fact that the CI error is not related to the PR).

Things we would need to do:
- [ ] set-up branch [branch protection rules](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule)
  + [ ] define required checks: probably azure + github doc build, maybe others. We probably want to leave aside other more noisy checks like codecov?
  + [ ] require 1 approval rather than 2 (to allow DOC PRs to be merged with only one approval)
- [ ] set-up [auto-merge](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-auto-merge-for-pull-requests-in-your-repository)
  + [ ] make sure we check the require required checks (Thomas' comment at the meeting)
  + [ ] reset auto-merge when a commit is pushed after auto-merge is set, just to be on the safe side. This [link](https://github.blog/changelog/2021-03-22-updated-pull-request-auto-merge-behavior-for-users-without-write-access/) says that it is done automatically, unclear whether this is the same thing as "Dismiss stale pull request approvals when new commits are pushed" setting in branch protection rules.

Other items from discussions at the meeting:
- Q: does a human have to click "auto merge" on a PR for it to happen, or does it automatically happen for all PRs that match the approval requirements?
- A: a per PR manual action is required to allow automerge, see screenshot above
- Q: is "merge when CI is green" functionality of "[Refined GitHub](https://github.com/refined-github/refined-github)" a solution?
- A: you need to keep the tab open for it to work, and in my limited experience it does not work reliably. Also it is not public information that the PR will be merged when CI is green.

COMMENT:
> If we allow for bypassing branch protections, does that mean only the "Admin" role can bypass it? If so, I am okay with allowing for bypassing branch protections and setting up auto-merge.

I think so, I checked the same sphinx-gallery PR with a separate test user (that don't have write permissions on sphinx-gallery) and I don't see the "bypass branch protection" checkbox:

![image](https://user-images.githubusercontent.com/1680079/204562849-da4e4449-8128-43d6-87b5-acc971e5a53f.png)

Labels: RFC