Seems like github provider is using Terraform under the hood, found this relevant issue. It proposes manually setting the branch protection rules and importing state, the Pulumi analog of refresh is not detecting the update branch protection rules leading to apply to still try and set them resulting in the 422.
https://github.com/integrations/terraform-provider-github/issues/1262