Switch to external PR workflow only

[trickeydan]

Would it be better to have everyone follow the same (less privileged) workflow? This could help us surface issues in things like CI that may not appear until someone outside the organisation try to contribute which would impeded us merging in there changes without some potentially unnecessary back and forth.

Originally posted by @sedders123 in #539

We should test the external PR as part of this issue, and update the documenation accordingly.

[trickeydan]

Reopening until #609 gets closed and the branch deleted. This is the last branch on the main repo.

After that is merged, we should email the mailing list and restrict writes.

[sedders123]

#609 looks to be merged, is this unblocked now?

[trickeydan]

To Do:

• Check that the docs reflect the new workflow
• Email the j5 mailing list to ensure that contributors know
• Lock down pushing of branches if possible