[repo] Add CODEOWNERS to protect workflows

CODEOWNERS

@@ -0,0 +1,21 @@
+# This is the CODEOWNERS configuration for the Moodle Developer Resources
+# For documentation, see:
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Only allow members of the integration team to approve changes to the
+# CODEOWNERS file.
+/CODEOWNERS   @moodle/iteam
+
+# Only allow members of the integration team to approve changes to the
+# .github directory, including all workflows, and other sub-directories.
+# This is to ensure that arbitrary changes to GitHub workflows are not made
+# which expose the repository, or its secrets.
+/.github/     @moodle/iteam
+
+# Only allow members of the integration team to approve changes to the
+# scripts directory and sub-directories.
+# These scripts are called from places including Github workflows, which
+# have access to secrets.
+/scripts/     @moodle/iteam
+
+