Extracted from #12276

Mostly extracted from
#12114

Closes #12129

When syncing permissions for SSO, we don't need to sync all repositories
the user has access to, we just need to update the permissions of the
repositories that are connected to projects that belong to SSO
organizations. So this adds a way to just update one single repository
at a time for all providers. We don't need to do this for GH app
projects, since they are kept up to date via a webhook.

Since this task should be faster now, we could run it more frequently,
so permissions are reflected faster on RTD.

For some related fields, Django first does a select, then it probably
loads each object into memory? But after that it does the deletion using
a `IN` statement with the ID of the objects...

Using raw_delete avoids that, but it can also cause integrity problems,
as Django does its own implementation of on_delete, so I chose models
that don't have additional relations and also shouldn't have problems as
they are always deleted when the project is deleted. Another source of
problems is when models have foreign fields with on_delete=SET_NULL, as
django will do an UPDATE over the model with all the related fields...
for example for latest_build, django will run an update over all
projects with an `IN (... all builds IDs..)`, to set the latest_build ID
to null..., which is silly since the whole project model is being
deleted, but django doesn't know that lates_build can only contain a
build from the project. A raw delete could help, but builds and versions
have a lot of related fields in other models, so I'm a little hesitant.

Closes #12410
Ref #10040

This is the same logic we have in


https://github.com/readthedocs/readthedocs.org/blob/a8a29fe29292027a4e2a44cc468cea4adc70e390/readthedocs/projects/models.py#L1164-L1181

and it already excludes latest

I'm doing small refactors to rely less on get_default_branch, as that
contains some extra logic that we already run to have latest always in
sync.

We should refactor this task so it doesn't require a version, but that's
a bigger change... This is basically the same as it was before, as
LATEST is the only version that its identifier is the same as the
default branch.

I'm doing small refactors to rely less on get_default_branch, as that
contains some extra logic that we already run to have latest always in
sync.

- Take into consideration active users from the last 30 days only.
- Ignore GitHub App, so we don't re-sync installations over and over
again, as users can share the same installation, and repos from the GH
app are kept in sync via a webhook.

This task now completes in 42 minutes.

Closes #12406

- This was duplicating the logic from git_identifier
- Our `latest` version already has the name of the branch/tag in the
identifier, no need to use `get_default_branch`
- We no longer create branches or tags with the origin prefix.


I'm doing small refactors to rely less on get_default_branch, as that
contains some extra logic that we already run to have `latest` always in
sync.

Extracted from
#10927, trying to get
a smaller diff on that PR :)

There are no reason to extract the entire archive when we only need
`git-lfs` binary.
The archive also contains a `CHANGELOG.md` file, which can override the
local one.