fix(server): Load private GitHub release assets in PR media#91

What Changed

Carries the current head of pingdotgg/t3code#21015 github-release-media. The GitHub media classifier recognizes release-download URLs (https://github.com/<owner>/<repo>/releases/download/<tag>/<asset>) and parses them as URLs, so www.github.com, an uppercase host or an explicit :443 resolve like the canonical form, and a tag containing / (for example release%2Fv1) stays intact. The GitHub driver's media fetch looks up the release by tag with the authenticated GitHub REST service, selects the exact asset by name and streams its binary API response. Redirects keep credentials on the GitHub allowlist and drop them on signed object hosts, public release images fall back to anonymous fetching, and the existing cache policy is unchanged.

Why

Private release-asset images in pull request descriptions bypassed the authenticated media proxy and showed "Image unavailable" (pingdotgg/t3code#21014). Loading the release URL directly fails for a private repository even with a token. This builds on the SAML SSO media layer below it.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes