GitHub support for infra repo

[shekharc-in]

Add GitHub provider support for infrastructure repositories

Summary

Nephio's Repository and Token controllers are currently hard-wired to Gitea.
This PR introduces a provider-agnostic git client abstraction and adds GitHub as
a second supported provider, so infrastructure repositories can be hosted on
GitHub as well as Gitea.

The provider is selected per-resource via a new spec.provider field on the
Repository CRD, defaulting to gitea.

What changed

Provider abstraction

• New git.Client interface (controllers/pkg/git/client.go) covering the
  operations the reconcilers need: user info, repo CRUD, and access-token
  lifecycle.
• New git/types package holding provider-neutral request/response types
  (Repository, User, AccessToken, CreateRepoOption, …), so reconciler
  code no longer depends on the Gitea SDK types directly.
• New git.ProviderType enum: gitea, github, gitlab. GitLab is declared
  but not implemented — the registration sites are marked so it can be added
  without further refactoring.

GitHub client

• New controllers/pkg/git/github implementing git.Client on top of
  google/go-github/v66.
• Hybrid authentication:
  • a Personal Access Token for regular API operations (repo CRUD, user info)
  • GitHub App installation tokens minted on demand via CreateAccessToken()
    for Porch to consume
• Credentials are read from a Kubernetes secret (personal_access_token,
  app_id, installation_id, private_key). Full setup instructions are in
  controllers/pkg/git/github/README.md.

Reconciler changes

• Both reconcilers now hold map[git.ProviderType]git.Client, populated at
  startup for whichever providers have credentials configured.
• Repository reconciler resolves the provider from cr.Spec.Provider.
• Token reconciler regenerates GitHub installation tokens on a 55-minute
  requeue, since they expire after one hour. Gitea tokens keep their existing
  create-once behaviour.

Package move

• controllers/pkg/giteaclient → controllers/pkg/git/gitea, now implementing
  the shared interface. Behaviour is unchanged.
• The generated mock moves to mocks/external/gitclient, in line with the
  existing mocks/external/... layout.

Backward compatibility

Existing Gitea deployments are unaffected. spec.provider is optional and
absent values resolve to gitea, preserving today's behaviour and secret
layout. No CRD field was removed or renamed.

Dependencies

Requires the companion API change adding provider, url and org to
RepositorySpec:

• nephio-project/api — "Add provider, url, and org fields to Repository CRD"

This PR cannot build or merge until that API change is released. See below.

Testing

• Unit tests for the GitHub client (githubclient_test.go) and the migrated
  Gitea client.
• Repository and Token reconciler tests reworked against the git.Client
  mock, retaining existing coverage.
• Full controllers/pkg suite passes locally (15 packages);
  nephio-controller-manager builds clean.

Before this can merge

Two items I'd like reviewer input on:

1. replace directives must be removed. Both controllers/pkg/go.mod and
   operators/nephio-controller-manager/go.mod currently carry
   replace github.com/nephio-project/api => ../../../api so the branch can
   build against the unreleased API change. These will fail CI and must be
   dropped once a release of nephio-project/api containing the new fields is
   available.

2. Pre-existing dependency conflict, surfaced by this work. Building against
   the current api main pulls nokia/k8s-ipam forward to
   v0.0.4-0.20241009045647-de66a47ea16c (bumped in api's "Bump go version and
   dependencies"). That version removes NephioInterfaceNameKey and
   NephioNodeNameKey, which henderiw-nephio/network still references — and
   that module appears unmaintained, with no release newer than
   v0.0.0-20231206051529-4287dc43f8a6. This breaks
   controllers/pkg/reconcilers/network, which is registered in
   nephio-controller-manager.

   This is not introduced by this PR — any consumer picking up the newer API
   module will hit it. A replace pinning k8s-ipam back works as a local
   stopgap, but a proper fix (forking/replacing henderiw-nephio/network, or
   dropping the dependency) is out of scope here. Guidance welcome.

[nephio-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign johnbelamaric for approval by writing /assign @johnbelamaric in a comment. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: shekharc-in / name: Shekhar (1327af6, 1fdc5f6, 3d9d70b, 487a9c2, 4bfc226, 5934eff, a1ffcb7, af5f76d, d5a83c0, f05def6)

[nephio-prow]

Hi @shekharc-in. Thanks for your PR.

I'm waiting for a nephio-project member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[shekharc-in]

/easycla