Reject unknown GitHub tokens in strict mode

• Add github.strict_scopes: a token that does not come from seed config, server options, an OAuth exchange, or an installation token request returns 401 Bad credentials instead of acting as the default user, and HTTP Basic is accepted only with a configured OAuth app's client credentials, which act as the app without a user.
• Keep the fallback in the default mode, with regression coverage and docs.

References:

• Invalid credentials return 401 Unauthorized; an OAuth app authenticates with its client ID and secret as Basic credentials, which are associated with the app and not with a user: https://docs.github.com/en/rest/authentication/authenticating-to-the-rest-api

Fixes #359