GOVERNANCE: Allow dev@ or PR votes for non-spec projects

[wking]

Email-based voting seems to be a blocker for @crosbymichael, who prefers PR-based voting for non-spec projects. And the image-tools maintainers had a PR-only vote to add @cyphar as a maintainer (opencontainers/image-tools#118).

Specifications are still recommended to only use dev@ (for increased visibility among folks with only peripheral involvement, e.g. spec consumers). But non-spec projects can backtrack more easily from decisions which have negative impacts, so we don't have to push them towards dev@ as firmly.

Adopting this more-relaxed approach should help reduce barriers to non-spec projects adopting the vanilla governance procedures, which may move us towards more consistency between OCI projects (#4).