Require two human reviewers on bot-authored pull requests

[mattdurak]

Bot-authored pull requests should not merge on a single approval. On a human-authored PR two people have
looked at the change -- the author who wrote and vetted it, and the approver. When the agent opens the PR
that first human is missing, so one approval is the only human judgement applied to it. This restores the
second.

The logic is a reusable workflow in
Azure/c-build-tools,
so every repository shares one definition and this file stays a thin caller. Nothing about it requires this
repository to consume c-build-tools any other way -- Actions fetches a reusable workflow from the pinned
ref, which is neither a checkout nor a submodule.

What it does:

• Runs on every pull request and passes immediately when the author is not a bot, so human-authored PRs are
  unaffected.
• On a bot-authored PR, requires approvals from two distinct humans who have push access, on the
  current head commit. An approval of an earlier commit does not carry over, because the bot pushes to
  its own PR.
• Keys on the author being a bot rather than on a list of bot names, so a renamed app cannot slip through.

It reports as a status check but is not required yet. Making it required before this file is on the
default branch would leave every open PR waiting on a check that cannot run, so that is a separate step
after this merges.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[mattdurak]

/azp run Azure-ctest-Gate

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).