Let Pilots read private repositories through a GitHub App

Adds a GitHub tab in Central Settings. Pilots get a read-only token for one chosen repository, valid for about an hour.