Read private repositories only with the user's own GitHub token

GITHUB_ACCESS_TOKEN belongs to the server, but any user could ingest any
repository it can see, private ones included. It is now used only for
public repositories; the loader checks the repository's visibility first
and asks for a GitHub connection otherwise.

The loader also takes a token from the connection a source syncs from.
Merging a connection's keys into a plain repository URL no longer fails
on json.loads, manual Sync now passes the source's connection, and a
token GitHub rejects pauses the connection's sources for reconnect.

tests/api/user/test_tasks.py

@@ -165,10 +165,20 @@ class TestSyncSourceTask:
         )
 
         mock_sync.assert_called_once_with(
-            ANY, {"data": 1}, "job1", "user1", "web", "daily", "classic", "doc1"
+            ANY, {"data": 1}, "job1", "user1", "web", "daily", "classic", "doc1",
+            connection_id=None,
         )
         assert result == {"status": "ok"}
 
+    @pytest.mark.unit
+    @patch("docsgpt.api.user.tasks.sync")
+    def test_passes_the_sources_connection(self, mock_sync):
+        from docsgpt.api.user.tasks import sync_source
+
+        sync_source({"data": 1}, "job1", "user1", "s3", "daily", "classic", "doc1", connection_id="c-1")
+
+        assert mock_sync.call_args.kwargs["connection_id"] == "c-1"
+
 
 class TestStoreAttachmentTask:
     @pytest.mark.unit