feat: add token source flag, gh cli auth

[gillisandrew]

This PR adds support for using the GitHub CLI's token. Users pass --token-source gh to enable it (defaulting to "env" token source). It also includes a couple of changes that should make it straightforward to publish a GitHub CLI extension (#215) that uses "gh" as the default source.

[Copilot]

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• go.mod: Language not supported

[Copilot]

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• go.mod: Language not supported

Comments suppressed due to low confidence (1)

cmd/github-mcp-server/main.go:227

• [nitpick] The variable name 'token_source' does not follow Go naming conventions. Renaming it to 'tokenSource' would improve readability and adhere to idiomatic Go style.

token_source := viper.GetString("token-source")

[pauldthomson]

Wondering if this should be leveraging cli/go-gh like it is or potentially instances of the MCP server being their own OAuth applications i.e. having their own client ID which could be implemented using this

[gillisandrew]

@pauldthomson Definitely agree, there should be some tooling provided by github-mcp-server to acquire the token so users aren't stuck generating PATs.

There is a broader discussion to be had about how fine-grained authorization could be handled by the server, given many users want to grant varying levels of access to different resources (e.g. read-write access to current repo, but read-only access to other repos). It could go a long way to addressing the perennial claims of github-mcp-server being "exploited" by poisoned prompts to extract private data.