Implement more merge policy logic

Along the lines of:

• block merging without at least some minimum level of review from any of:
  • some minimum level of permissions;
  • assigned reviewer(s); or
  • branch status results
• block based on negative review from someone with a minimum level of permissions;
• others?

Cc: @brad.king