GitHub: `/installation/repositories`, repository archives (`tarball`/`zipball`) and code-scanning SARIF upload (feature request)

Request

Three GitHub App endpoints that repository-scanning integrations call are missing (checked on main at 4c0422e). Repository listings already advertise repositories_url: ${baseUrl}/installation/repositories and tag tarball_url/zipball_url, but the routes answer 404.

1. GET /installation/repositories with an installation token: { total_count, repository_selection, repositories: [...] }, paginated (per_page, page), honouring repository_selection: selected. Docs: https://docs.github.com/en/rest/apps/installations#list-repositories-accessible-to-the-app-installation
2. GET /repos/:owner/:repo/tarball/:ref and /zipball/:ref: a 302 to a download URL serving the archive of the ref, top directory owner-repo-<sha7>/ as GitHub does. Docs: https://docs.github.com/en/rest/repos/contents#download-a-repository-archive-tar
3. POST /repos/:owner/:repo/code-scanning/sarifs (commit_sha, ref, sarif gzip+base64) returning { id, url }, and GET .../sarifs/:id with processing_status. Docs: https://docs.github.com/en/rest/code-scanning/code-scanning#upload-an-analysis-as-sarif-data

Separately: the installation-token App attribution on check runs (#295) is fixed on main but 0.12.2 still returns app: null. A release would let pinned consumers pick it up.