feat(provider): add a refresh strategy for github app installations

[grs]

Summary

Add gateway-managed minting and rotation of GitHub App installation tokens. Operators configure an app and installation with explicit repository and permission scope; long-running workloads retain access
across token rotations without receiving the app’s private key.

Related Issue

Changes

• Add the github_app_installation refresh strategy, including RSA JWT signing, scoped token requests, expiry handling, and secret-free failure diagnostics.
• Store app private keys through the credential driver and reuse existing refresh configuration, status, and rotation commands.
• Add an importable GitHub App profile supporting API access and Git HTTPS clone/fetch.
• Update protobuf, CLI, TUI, Go SDK, and documentation.
• Add independent GitHub E2E coverage with local HTTPS fixtures and real gh and Git clients.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.