Add a built-in GitHub connector for repository sync and read-only tools

One GitHub connection feeds both a Knowledge source and an agent tool.
Users connect with a personal access token, checked against GitHub and
named after the account, or, when an admin registers a GitHub App
(GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, GITHUB_APP_SLUG), with Sign in
with GitHub. App tokens expire after eight hours and are refreshed before
each sync or tool call; tokens with no expiry are never treated as expired.

The catalog gains an optional second sign-in method (oauth_settings,
exposed as sign_in_methods) without changing any other connector.

Sync lists the repositories the connection can read (the token's own, or
the App installations') and ingests one with the connection's token. The
tool is GitHub's read-only MCP server (api.githubcopilot.com/mcp/readonly):
setup discovers its actions and creates it bound to the connection, and
the executor sends the connection's token only to that server.

docsgpt/core/settings/connectors.py

@@ -44,7 +44,23 @@ class ConnectorSettings(SettingsGroup):
     CONFLUENCE_CLIENT_SECRET: Optional[str] = Field(default=None, description="Confluence Cloud OAuth client secret.")
 
     # GitHub source.
-    GITHUB_ACCESS_TOKEN: Optional[str] = Field(default=None, description="GitHub PAT with read access to repositories.")
+    GITHUB_ACCESS_TOKEN: Optional[str] = Field(
+        default=None,
+        description=(
+            "Instance-wide GitHub token for the public-repository upload. It raises GitHub's rate limit and is never "
+            "used to read a private repository; users connect their own GitHub account for those."
+        ),
+    )
+    # GitHub App behind "Sign in with GitHub" on the GitHub connector.
+    GITHUB_CLIENT_ID: Optional[str] = Field(
+        default=None,
+        description="GitHub App client id. With the secret and slug, offers Sign in with GitHub next to tokens.",
+    )
+    GITHUB_CLIENT_SECRET: Optional[str] = Field(default=None, description="GitHub App client secret.")
+    GITHUB_APP_SLUG: Optional[str] = Field(
+        default=None,
+        description="GitHub App URL name (github.com/apps/<slug>), for the link where users choose repositories.",
+    )
 
     MCP_OAUTH_REDIRECT_URI: Optional[str] = Field(
         default=None, description="Public callback URL for MCP OAuth; unset derives it from CONNECTOR_REDIRECT_BASE_URI."