Be Compliant with Zalando Open Source Rules

[lukasniemeier-zalando]

As per https://opensource.zalando.com/docs/releasing/index/#be-compliant we have some homework to do in order to be compliant with the rules of a Zalando open source project. Although we have effectively followed them, it makes sense to look into ways how we can enforce them more strictly.

The following rules we currently do not enforce by technical means:

1. Sign-off every commit - we currently allow unsigned commits to be pushed/merge into the main branch
2. Enforce code-reviews with at least 2 sets of Zalando eyes - we currently only require 1 set of Zalando eyes

[lukasniemeier-zalando]

We've agreed to stick with pr-opener plus 1 reviewer (via #1612). Commit signing has been turned on ✔️