Add a built-in GitHub connector for repository sync and read-only tools

One GitHub connection feeds both a Knowledge source and an agent tool.
Users connect with a personal access token, checked against GitHub and
named after the account, or, when an admin registers a GitHub App
(GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, GITHUB_APP_SLUG), with Sign in
with GitHub. App tokens expire after eight hours and are refreshed before
each sync or tool call; tokens with no expiry are never treated as expired.

The catalog gains an optional second sign-in method (oauth_settings,
exposed as sign_in_methods) without changing any other connector.

Sync lists the repositories the connection can read (the token's own, or
the App installations') and ingests one with the connection's token. The
tool is GitHub's read-only MCP server (api.githubcopilot.com/mcp/readonly):
setup discovers its actions and creates it bound to the connection, and
the executor sends the connection's token only to that server.

docs/content/Deploying/Settings-Reference.mdx

@@ -1140,7 +1140,25 @@ Confluence Cloud OAuth client secret.
 
 Type `str`, default unset.
 
-GitHub PAT with read access to repositories.
+Instance-wide GitHub token for the public-repository upload. It raises GitHub's rate limit and is never used to read a private repository; users connect their own GitHub account for those.
+
+### `GITHUB_CLIENT_ID`
+
+Type `str`, default unset.
+
+GitHub App client id. With the secret and slug, offers Sign in with GitHub next to tokens.
+
+### `GITHUB_CLIENT_SECRET`
+
+Type `str`, default unset.
+
+GitHub App client secret.
+
+### `GITHUB_APP_SLUG`
+
+Type `str`, default unset.
+
+GitHub App URL name (github.com/apps/<slug>), for the link where users choose repositories.
 
 ### `MCP_OAUTH_REDIRECT_URI`