Update to CoCo policy

Add words about github and 2factor auth.

Author: kelle

policies/coco-operating-policies.md

@@ -87,6 +87,10 @@ Used for private, informal conversations among CoCo members. A new channel is cr
 each time CoCo membership changes. There is a strong expectation of privacy and
 messages should not be shared without express permission of the sender.
 
+## GitHub Privileges 
+
+CoCo members typically have owner priviliges of the Astropy organization, but it is not mandatory. The accounts which have owner priviliges must have two-factor authentication enabled. 
+
 ## CoCo membership history
 
 ### CoCo3 (Elected Sep 2021)