Add a section describing our ideal code review workflow

This both adds that code reviews before merging are expected,
and gives guidance for both the author and reviewer on what
to do.

Thanks to Edmund von der Burg and Matthew Somerville for
corrections and suggestions.