Configure vouch

Vouch workflow added to gate pull requests; PRs from vouched users or maintainers are auto-closed, others can recheck.