deps(go): bump module github.com/jferrl/go-githubauth to v1.7.0 - #9625

## [v1.7.0] - 2026-06-30

GitHub Enterprise Cloud (GHEC) support and a more foolproof installation-token configuration.

### Added

- **Custom Base URL**: New `WithBaseURL` option sets the API base URL verbatim (only normalizing a trailing slash), mirroring how `go-github` targets a custom endpoint. Unlike `WithEnterpriseURL`, it does not append `/api/v3/`, enabling GitHub Enterprise Cloud with data residency (`https://api.SUBDOMAIN.ghe.com/`) and pointing the client at an `httptest` server in tests (#50)

### Changed

- **Order-independent options**: `WithBaseURL`, `WithEnterpriseURL`, `WithHTTPClient`, and `WithRetryOnThrottle` can now be combined in any order. Previously `WithHTTPClient` rebuilt the client and silently discarded a base URL or retry setting applied before it
- **Fail-loud configuration**: An invalid base URL (or a `nil` HTTP client) is now reported by the first call to `Token()` instead of silently falling back to the public GitHub API

### Fixed

- **HTTP client no longer mutated**: `WithHTTPClient` operates on a shallow copy, so the caller's `*http.Client` (which may be shared elsewhere) keeps its original transport
- **No panic on nil client**: passing `nil` to `WithHTTPClient` now yields a clear error instead of panicking

### Maintenance

- Removed the deprecated, no-op `net.Dialer.DualStack` field from the pooled HTTP client
- Renamed the unexported `githubClient.client` field to `httpClient` for clarity

### Tests

- Added coverage for `WithBaseURL` (GHEC and `httptest` URLs), option order-independence, fail-loud misconfiguration, and verification that the caller's HTTP client is not mutated

### Dependencies

- Bumped `actions/cache` from 5 to 6 (#49)
- Bumped `actions/checkout` from 6 to 7 (#48)
- Bumped `codecov/codecov-action` from 6 to 7 (#46)

**Full Changelog**: <https://github.com/jferrl/go-githubauth/compare/v1.6.0...v1.7.0>

## ✨ Features

### External key store support for GitHub App JWTs
Added `NewApplicationTokenSourceFromSigner` which accepts any `crypto.Signer` with an RSA public key. Enables signing via AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault Transit, PKCS#11 HSMs, or ssh-agent — the private key never touches process memory. Validates at construction that the signer's public key is `*rsa.PublicKey` (GitHub requires RS256).

```go
signer, _ := kms.NewSigner(ctx, keyID) // any crypto.Signer backed by RSA
ts, err := githubauth.NewApplicationTokenSourceFromSigner(appID, signer)
```

### Proactive token refresh with configurable skew
New `ReuseTokenSourceWithSkew` refreshes cached tokens when `time.Until(exp) <= skew` instead of waiting for expiry to pass. Closes the in-flight 401 window where a request starts shortly before expiry and reaches GitHub already expired.

`NewApplicationTokenSource` and `NewInstallationTokenSource` now wrap with `DefaultExpirySkew` (30s); tune via `WithExpirySkew` / `WithInstallationExpirySkew`. Zero/negative skew delegates to `oauth2.ReuseTokenSource` verbatim for backwards compatibility.

### Automatic retry on installation token throttling
`createInstallationToken` now performs a single automatic retry when GitHub returns `429`, or `403` with `Retry-After` / `X-RateLimit-Reset` headers. Sleep honors context cancellation and is capped at 60s. Terminal throttle errors wrap `ErrRateLimited` for `errors.Is` branching. Opt out via `WithRetryOnThrottle(false)`.

### New `webhook` subpackage
Added a `webhook` package for verifying GitHub webhook deliveries using constant-time HMAC-SHA256:

- `Verify(secret, body, signature)` with sentinel errors (`ErrMissingSignature`, `ErrInvalidSignatureFormat`, `ErrSignatureMismatch`) wrapped for `errors.Is` / `errors.As`.
- `Middleware(secret, opts...)` `net/http` middleware with body restoration, 25 MiB default cap, and 401/413 short-circuits.
- Functional options `WithMaxPayloadSize` and `WithErrorHandler`.
- Suitable for direct use in queue, Lambda, or Cloud Run consumers.

```go
http.Handle("/webhook", webhook.Middleware(secret)(handler))
```

## 📦 Dependencies
- Bump `golang.org/x/oauth2` from 0.34.0 → 0.36.0
- Bump `codecov/codecov-action` 5 → 6
- Bump `styfle/cancel-workflow-action` 0.13.0 → 0.13.1

## ⚠️ Breaking / Behavior Changes
- **Minimum Go version is now 1.25** (transitively required by `golang.org/x/oauth2` v0.36.0). README previously claimed 1.21; the actual floor is now enforced.
- Token sources refresh **30s before expiry** by default. Set skew to `0` via `WithExpirySkew(0)` / `WithInstallationExpirySkew(0)` to restore prior behavior.

**Full Changelog**: https://github.com/jferrl/go-githubauth/compare/v1.5.1...v1.6.0