fix(auth): scope tokens across GitHub clients

Use exact configured host authorities for every REST, GraphQL, and raw client so redirects cannot reattach credentials to foreign hosts or ports. Add adversarial redirect and lookalike coverage.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>