add CODEOWNERS across the organization

[driif]

Create PR with CODEOWNERS across the organization - exclude go-kms-wrapping and the two plugin repos.

Create PR with CODEOWNERS for release/2.3.x

[DrDaveD]

I understand the value of having CONTRIBUTING and GOVERNANCE files in all the repositories as mentioned in #39 but I don't understand the value of copying CODEOWNERS. Please explain. As I understand it, CODEOWNERS is helpful for a large repository that has many subpieces that have different owners. That is not the case in at least some of the other repositories.

[driif]

Thank you for your question @DrDaveD,
It was a topic of Supply Chain Security WG and is related to enforcing or adjusting branch protections in all repos across organization.

https://docs.google.com/document/d/1LkidkOPzOZGPR6bGB6bXD7pTTw5kct75mC9lbyTYrVU/edit?tab=t.0

[cipherboy]

@DrDaveD Mostly it is for consistency. We'd like to enforce the same protection ruleset across all repos in the organization, which also includes CODEOWNERS.

To answer a more concrete benefit, I think it will also be part of the defense-in-depth for updates to access the repository. If a user/group is added with permissions, they'll still need to also be added to CODEOWNERS for them to merge any changes which will require a PR and an existing group (or global admin) to override.

I was trying to recall recently but I think there was a scenario where we wanted to give just read access, but write was required for the feature to work... Maybe access to the security/code scanning tab? write would let them approve and merge PRs, but CODEOWNERS would prohibit it, which'd be ideal.