CFTL-589 GitHub OAuth as a third git authentication method

[Oscar-XXII]

Why

Cloning a private repository has so far required the customer to create and rotate a credential by hand, and a classic PAT grants read and write across every private repository the user can reach. Enterprise security reviews keep flagging it.

This adds a third option: authorize a Keboola-owned GitHub App through the OAuth broker and receive a user access token limited to Contents: Read-only on the repositories chosen at installation time. SSH and PAT are untouched.

What changed

• New oauth value on git.auth. Appended to the existing enum, so the radio order for existing configurations does not move.
• Token handling. The access token arrives outside parameters, in the authorization section. It is handed to git through a GIT_ASKPASS helper, so it never appears in the command line, in the cloned repository's .git/config, or in the environment of the executed user script.
• authorization is stripped from the config.json written for the user script. Besides the user's own token it carries #appSecret — the shared application secret of the Keboola GitHub App — which no user code may be able to read. This is the most important change in the PR and it is covered by a test.
• Repository picker. New listRepositories sync action backed by /user/installations + /user/installations/{id}/repositories, both paginated and aggregated across installations. A user access token carries no installation id of its own, hence the two calls. git.url stays free text for the other auth methods; OAuth configurations select into git.repository instead, because a schema field cannot be a dropdown and a text input at once.
• Private git dependencies. uv sync shells out to git, which had no credentials — this is what broke the first real test run. SubprocessRunner.run gained an optional env and the dependency install now receives the git credentials explicitly. The executed script keeps inheriting the untouched process environment.
• Error messages. Missing authorization, a non-GitHub URL, a revoked token, and a repository the app cannot see each produce an actionable UserException instead of a raw git or HTTP error.
• Docs: setup flow, the app's client ID, and why the installation must use Only select repositories.

37 tests, flake8 clean.

Verified on the platform

Job 53340777 in project 4214 (us-east4.gcp), image CFTL-589-143:

Git OAuth authentication set up for GitHub URL.
Cloning git repository: https://github.com/keboola/component-custom-python-example-3.git
Successfully cloned repository

That run confirms the broker token, the askpass helper and the clone all work end to end against real GitHub. It then failed in uv sync on a private dependency — which is the bug fixed in aba710a. A re-run on a build containing that fix is still pending.

Not verified

• listRepositories has only been exercised against mocks. Against the keboola organisation it returns a truncated response; whether that is a response size cap or the pod being killed mid-write is not yet established (running it twice and comparing the cut point settles it).
• The dependency fix has not yet run on the platform.

Reviewer notes

• The _merge_user_parameters change is the security-critical one.
• source_git.py looks larger than it is: self.git_cfg.url was replaced by a single resolved self.repo_url, and self.env became a git_env overlay resolved at call time — the previous snapshot predated the virtual environment selection and would have pointed uv sync at the wrong environment.

🤖 Generated with Claude Code

[linear-code]

CFTL-589