Git access: restrict token permission to just this repo

[CptOblivion]

when granting git permission to the app, currently it grants to other unrelated repos as well

[CptOblivion]

Probably want to use Github Apps: https://docs.github.com/en/apps/creating-github-apps/about-creating-github-apps/about-creating-github-apps
This should give permissions to just the one repo (and I think it supports github SSO for an easier login flow too)

[CptOblivion]

Suggested plan from AI:

1. Install a GitHub App on the upstream repo with minimal permissions:
* issues: write
* metadata: read
2. Add GitHub App user authorization flow to your login page:
* User clicks "Sign in with GitHub App"
* Redirects to GitHub App authorization
* User grants permission
* App generates a user-to-server token
* Service stores that token for the user's session
3. Create issues attributed to the user:
* Use the user-to-server token to create an issue
* Issue appears authored by the actual user
* GitHub App badge shows it was created via the app
4. Least privilege achieved:
* App is installed only on the target repo
* App only has issues: write (not repo or contents scope)
* Users authenticate separately per session
* The app can only do what its permissions allow

NOTE: I'm not sure if this would support the users making PRs; we may need to switch to users filing issues instead, along with or before this change. (I think this is probably a better option anyways, but that's just me)

NOTE: apps are set up in github through their interface, not in the git repo itself; some alternative may be required to run/test a local version. Maybe a mock apps interface or something for the dev deploy