fix(github): store oauth tokens per user and secure the callback

[kaulith]

Summary

This PR fixes GitHub OAuth authentication by moving credentials to a per-user model, securing the OAuth flow, and ensuring GitHub actions are performed on behalf of the authenticated user instead of the app installation.

Changes

Per-user GitHub tokens

• GitHub access tokens are no longer stored in the Hive Settings singleton.
• Tokens are now stored in the GitHub Token doctype, with one record per user, which is the intended purpose of the doctype.
• This prevents one user's connection from overwriting another user's credentials.

Fixed OAuth callback flow

Previously, the OAuth callback never completed during the GitHub App installation flow because it required a state parameter, while GitHub's post-install redirect does not include one.

This PR:

• Adds a Connect GitHub Account button in Settings.
• Includes a valid state parameter in the installation flow.
• Allows installing the GitHub App and connecting the user's account in a single flow.

Secured OAuth state validation

The previous implementation decoded an unsigned Base64-encoded JSON payload and compared the embedded user with the current session user.

This was not a secure validation mechanism, as an attacker could craft a callback URL containing their own OAuth code and have another authenticated user associate their Hive account with the attacker's GitHub identity.

The implementation has been replaced with:

• A server-generated, single-use nonce.
• Server-side storage of the nonce against the authenticated session.
• Validation and invalidation of the nonce during the callback.

This issue was not exploitable previously because the stored access tokens were never used. It becomes exploitable once user tokens are used for GitHub operations, which this PR introduces.

User-authenticated GitHub operations

create_issue now authenticates using the connected user's GitHub access token instead of the GitHub App installation token.

As a result:

• Issues are created under the authenticated user's GitHub account.
• Users who have not connected their GitHub account are prompted to do so instead of silently creating issues through the app installation.

Removed unused settings

The following fields have been removed from Hive Settings:

• github_access_token
• github_username
• github_authorized_at

These fields are no longer used.

Migration Note

The previous implementation stored github_access_token using db_set, which bypasses Frappe's password encryption.

If a site has previously connected a GitHub account, the legacy tabSingles entry containing github_access_token should be removed manually after deploying this change.