Check only a merge ability for protected actions

What does this MR do?

This MR changes how we protect CI/CD manual actions (also called protected actions).

We used to check a repository branch push ability but we found a workflow problem, so we decided to check a repository branch merge ability instead.

Does this MR meet the acceptance criteria?

• Changelog entry added
• Documentation updated
• Tests added for this feature

What are the relevant issue numbers?

Closes #32618 (closed)