GitHub: strict mode to reject tokens the emulator never issued

Problem

GitHub answers 401 Bad credentials to a request made with a token it never issued or one that was revoked. The emulator authenticates any unknown token as the default fallback user, and revoking an OAuth app from the user's settings removes the token from the token map, so the revoked token keeps working as that default user. Tests asserting that a revoked or made-up token fails cannot represent it, and the GitHub emulator has no strict mode to opt into.

Proposal

• Add github.strict_scopes, matching the Google, Slack, and Linear settings: in strict mode, a token that does not come from seed config, server options, an OAuth exchange, or an installation token request returns 401 Bad credentials.
• Keep the fallback user in the default mode.

Implementation

A working version with tests and docs is on a fork branch: https://github.com/Unchallenged-com/emulate/tree/github-strict-unknown-tokens. Happy to open a pull request for it.