fix(github): upgrade go-github to v89 to remove unmaintained openpgp

[alexfalkowski]

Fixes #1410.

Bumps the github and github-ee source drivers from go-github/v39 to v89, which removes golang.org/x/crypto/openpgp from the module graph entirely — go mod why golang.org/x/crypto/openpgp now reports the package is not needed.

Worth highlighting

• This is an API adaptation, not only a version bump. v89 reworked client construction:
  • github: NewClient(*http.Client) → options-based NewClient(...ClientOptionsFunc) (*Client, error). The token path now uses github.WithAuthToken(...), dropping the driver's direct golang.org/x/oauth2 dependency (now indirect via other sources).
  • github-ee: NewEnterpriseClient(base, upload, httpClient) was removed → NewClient(WithHTTPClient(...), WithEnterpriseURLs(base, upload)). URL normalization is equivalent — parseURL appends the trailing slash before the /api/v3/ check, so https://host/api/v3 still resolves to /api/v3/.
• No behavior or URL-contract change for github:// or github-ee://; the content API (GetContents / DownloadContents) is unchanged.

[coveralls]

coverage: 54.447% (+0.04%) from 54.412% — alexfalkowski:fix/go-github-v89 into golang-migrate:master

[alexfalkowski]

The test (1.26.x) failure looks like a flaky container-readiness timeout rather than something from this change:

• The only failing subtest is Test/test/yugabytedb/yugabyte:2025.2.2.2-b11, which timed out at exactly 60s. That same image passes in the sibling subtests in the same run (testMigrate, testMultiStatement, testFilterCustomQuery) — YugabyteDB just lost the readiness race in that one case.
• test (1.25.x) passed on the identical commit, and this PR only touches source/github and source/github_ee, nothing that reaches database/yugabytedb.

Could a maintainer re-run the failed job when you get a chance? Thanks!