GitHub: private repositories return 401 or 403 instead of 404

Problem

GitHub documents that "if you make a request to access a private resource and your request isn't properly authenticated, you will receive a 404 Not Found response", because it "uses a 404 Not Found response instead of a 403 Forbidden response to avoid confirming the existence of private repositories" (https://docs.github.com/en/rest/using-the-rest-api/troubleshooting-the-rest-api). For a token without sufficient permissions, the documentation allows "a 404 Not Found or 403 Forbidden response" (https://docs.github.com/en/rest/authentication/authenticating-to-the-rest-api). The emulator answers 401 to anonymous callers and 403 to users who cannot see a private repository, which confirms that it exists, so tests of removed access or of probing for private repositories see a different response than on GitHub.

Proposal

• Answer anonymous callers with 404 Not Found for a private repository, as documented, and users who cannot access it with 404 too, the documented option that does not confirm the repository exists, on reads and writes.
• Keep the existing errors for installation tokens.

Implementation

A working version with tests and docs is on a fork branch: https://github.com/Unchallenged-com/emulate/tree/github-private-repo-not-found. Happy to open a pull request for it.