chore: set up CODEOWNERS as a deny-list

This gives users with at least a Developer role approval rights, except
for when there's a more specific rule listed explicitly.

This makes CODEOWNERS more about code quality and less about
gatekeeping.