Compliance: Merge request approval rules