Implement GitLab HTTP client with safety invariants and optional token

[dpritchett]

Summary

Build the core HTTP client that all tools use. Single get() chokepoint that enforces safety invariants. Support optional token for rate-limit relief.

Safety invariants

1. GET-only — only http.MethodGet, hardcoded
2. Pinned hosts — requests only go to hosts listed in config
3. No credentials by default — no auth headers unless a token is explicitly configured
4. Rate-limit awareness — detect HTTP 429, parse Retry-After and RateLimit-Remaining headers, surface clear errors

Optional token

• Loaded from env var specified in config (e.g. REPO1_TOKEN)
• Sent as Private-Token header when present
• Does NOT change the public-only enforcement — visibility check still runs regardless
• The token may have broader access than intended (GitLab tokens inherit the user's permissions). The tool is the policy layer, not the token. Document this clearly.

Config

Multi-host config file at ~/.config/gitlab-kiosk/config.yml:

hosts:
  - hostname: repo1.dso.mil
    token_env: REPO1_TOKEN
  - hostname: gitlab.com

Related issues

• See Local checkout awareness: map remote GitLab repos to local clones #21 — config file format design (host list, token env vars, and local checkout registry should all live in one config file)