✨ Move "EnforcesAdmins" to tier 5 Branch-Protection

[spencerschrock]

What kind of change does this PR introduce?

half bug fix, half feature?

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

The EnforcesAdmin setting is an admin only setting when configured via Branch-Protection.
Under repo rules, the setting is available via Bypass Actors (although we can't see who the bypass actor is).
As this setting is currently in tier 1, repos which declare any bypass actors will be limited to a score of 2 in tier 1.

Given the lack of visibility we have into exactly how it's configured, I don't think we should penalize repos to stay in tier 1. For example, https://github.com/abcxyz/pkg enforces its repo rules on its admins, but it does have a bypass actor defined for break glass scenarios.

{
  "date": "2023-09-20T13:17:28-07:00",
  "repo": {
    "name": "github.com/abcxyz/pkg",
    "commit": "HEAD"
  "score": 2,
  "checks": [
    {
      "details": [
        "Info: 'force pushes' disabled on branch 'main'",
        "Info: 'allow deletion' disabled on branch 'main'",
        "Warn: settings do not apply to administrators on branch 'main'",
        "Warn: status checks do not require up-to-date branches for 'main'",
        "Info: 'last push approval' enabled on branch 'main'",
        "Info: status check found to merge onto on branch 'main'",
        "Warn: number of required reviewers is only 1 on branch 'main'",
        "Info: stale review dismissal enabled on branch 'main'",
        "Info: codeowner review is required on branch 'main'"
      ],
      "score": 2,

What is the new behavior (if this is a feature change)?**

The setting is moved to tier 5 (the "admin thorough review" level), so repos will still get credit for some of the other branch protections they do.

{
  "date": "2023-09-20T14:36:58-07:00",
  "repo": {
    "name": "github.com/abcxyz/pkg",
    "commit": "HEAD"
  },
  "score": 5,
  "checks": [
    {
      "details": [
        "Info: 'force pushes' disabled on branch 'main'",
        "Info: 'allow deletion' disabled on branch 'main'",
        "Warn: status checks do not require up-to-date branches for 'main'",
        "Info: 'last push approval' enabled on branch 'main'",
        "Info: status check found to merge onto on branch 'main'",
        "Warn: number of required reviewers is only 1 on branch 'main'",
        "Info: stale review dismissal enabled on branch 'main'",
        "Warn: settings do not apply to administrators on branch 'main'",
        "Info: codeowner review is required on branch 'main'"
      ],
      "score": 5,

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

NONE

Special notes for your reviewer

We may run into more situations like this, as all "for administrators" settings will start to influence score calculation. I prioritized this one, as it was tier 1.

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

The Enforces Admin setting is moved to Tier 5 of Branch-Protection to support repo rules.

[codecov]

Codecov Report

Merging #3502 (b8f0c2b) into main (6aa3bcc) will decrease coverage by 7.38%.
The diff coverage is 100.00%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3502      +/-   ##
==========================================
- Coverage   74.33%   66.95%   -7.38%     
==========================================
  Files         188      188              
  Lines       13444    13425      -19     
==========================================
- Hits         9993     8989    -1004     
- Misses       2890     3937    +1047     
+ Partials      561      499      -62