Better define org access #101

We've been pretty liberal about adding people to the org, which I think is a good thing, but we also lean on "org members" in several places to define access to other repos. One of the assumptions when we do this is that org members are a committer somewhere, which is usually true, but it turns out that there are many org members that are not committers in any repo.

We either need to come up with better conditions for org access or remove org access as a shorthand for "people with commit somewhere" in other policies.