feat(auth): add custom github app authentication with automatic token refresh

[alcoholmajuu]

Summary

Adds custom GitHub App (Server-to-Server) authentication support with automatic token refresh and retry mechanisms for the local (stdio) MCP server.

Why

This change is needed to allow the MCP server to run securely as a GitHub App installation in automated, CI/CD, or enterprise environments without relying on Personal Access Tokens (PATs) or interactive OAuth logins.

What changed

• Added NewGitHubAppTokenSource in pkg/utils/github_app.go to support automatic JWT signing and installation access token requests.
• Integrated go-resty/resty/v2 with exponential backoff retries for 5xx/429/network errors.
• Refactored cmd/github-mcp-server/main.go to expose App ID, Installation ID, and Private Key configuration CLI flags and environment variables.
• Standardized configuration pipelines (internal/ghmcp/server.go, pkg/http/server.go, pkg/github/dependencies.go) to consume standard oauth2.TokenSource.
• Added unit tests in pkg/utils/github_app_test.go and documented configurations in README.md.

MCP impact

• No tool or API changes
  • No new MCP tools or tool schema changes were introduced; this only changes the authentication backend configuration.
• Tool schema or behavior changed
• New tool added

Prompts tested (tool changes only)

N/A - No tool changes

Security / limits

• No security or limits impact
• Auth / permissions considered
  • Introduces secure Server-to-Server App token source, generating short-lived installation access tokens in-memory.
• Data exposure, filtering, or token/size limits considered
  • The App private key is parsed and validated at startup to fail-fast. Active token is cached safely with thread-safe synchronization.

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
• I am not renaming tools as part of this PR

Lint & tests

• Linted locally with ./script/lint
  • Manually checked the static analysis warnings and ran build verification locally.
• Tested locally with ./script/test
  • Wrote new unit tests inside github_app_test.go and verified they pass alongside existing test suites.

Docs

• Not needed
• Updated (README / docs / examples)
  • Updated the Local Server Authentication section in README.md to document the new GitHub App configurations.