Upgrade GitHub connection security

Connecting a GitHub organization to a workspace now confirms that the person connecting it owns that organization.

• Added a GitHub authorization step when installing the TofuPilot app, so the installation is verified against your GitHub account before it is linked.
• Added a read-only organization membership permission to the TofuPilot GitHub app. It covers members and their roles, with no access to code.
• Updated existing installations to keep working as they are. Organization owners are asked to accept the new permission before their next reconnect.