Attach the GitHub token only to configured GitHub hosts

BearerAuthTransport sets the Authorization header on every request it handles. Go's net/http strips that header when a redirect crosses to a different host, but only for headers set on the first request. Because the transport added the header again on each hop, a redirect that left the configured GitHub hosts would have carried the token with it.

The PR says plainly that this was not reachable with an attacker-controlled destination at the time, because GitHub's cross-host redirects resolve to GitHub-owned hosts. The change stops depending on that assumption.

A CheckRedirect function that strips Authorization is the first thing most people try. Here it fails, because the transport puts the header back on the next hop. The decision about the credential has to be made in the transport, at the point where the header is set.

The token is attached only when the request host is one of the configured GitHub hosts (REST, GraphQL, upload, raw). An empty AllowedHosts keeps the old behavior, so it is backward compatible. Tests cover the token reaching allowed hosts, being withheld from a non-allowed redirect target and from arbitrary hosts, and the empty default.