Support GitHub App installation tokens for push/sync

[Copilot]

push/sync call GET /user before anything else. GitHub App installation tokens (ghs_*) have no user context, so that call returns 403 Resource not accessible by integration and the tool can't be used with an App. This PR adds an opt-in --github-app-auth flag, following the approach in actions/actions-sync#177.

codeql-action-sync push \
  --destination-url https://ghes.example.com \
  --destination-token ghs_xxx \
  --destination-repository my-org/codeql-action \
  --github-app-auth

Behavior with --github-app-auth

• Skips GET /user, organization creation and Actions admin impersonation, since all three need a user.
• Creates the repository via POST /orgs/{owner}/repos (or updates it via PATCH) in the owner from --destination-repository. That organization must already exist and have the App installed. --actions-admin-user is ignored.
• A 403/404 when creating or updating the repository returns an App-specific message listing what the App needs: the org exists, the App is installed with access to the repository, and it has Administration/Contents/Workflows write. Without the flag, these cases fall through to messages about OAuth scopes, which don't apply to Apps. The underlying API error is still wrapped in the message.
• Git push needs no change: it already uses x-access-token as the basic-auth username.

Personal access token path

• The user/org logic moved out of createRepository into a new getDestinationOrganization helper. Its logic is unchanged; only the return values were adapted.
• One addition: a 403 on GET /user now suggests re-running with --github-app-auth.

Docs and tests

• README: the flag is listed under both commands, plus a new "Authenticating with a GitHub App" section. It covers required permissions, limitations, and the one-hour token expiry (re-running skips assets that were already uploaded).
• Unit tests cover App-auth create and update, the create-403 and update-404 error messages, and the missing-flag hint. The App-auth tests register a /api/v3/user handler that calls t.Error. They need it because the test server returns a 404 for unregistered paths without failing the test.

Review focus

• The flag doesn't reject an explicit --actions-admin-user; the README says it is ignored. actions-sync rejects that combination. Doing the same here would need Flags().Changed, because --actions-admin-user has a default value.

• Fixes GitHub App installation token authentication for push/sync #182

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[Copilot]

🔵 Needs a closer look

End-to-end verification of the installation-token authentication path remains outstanding.

0 open findings

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟢 Approval recommended

The opt-in flow preserves existing authentication behavior, with focused tests and no identified blocking issues.

0 open findings

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.