New repository settings for configuring pull request access (github.blog)

and insufficient for the growing bot spam problem