GitHub App tokens, push limits and API budgets for secrets

A secret can now hold a GitHub App's private key (githubApp): our servers make its installation tokens and add them to your sandboxes' GitHub requests and git pushes, and the key itself goes into no request. git.push names the branches a push may update, such as refs/heads/task/{label.task}: each label's branch belongs to the first sandbox made with it, even once it is deleted, and that label can't change after the sandbox is made. Any other push is refused with git's own [remote rejected], as is any API call that would move, merge or write to another branch. api caps each sandbox's calls and writes an hour, lists the GraphQL mutations allowed, and lets sandboxes share cached reads. A rule's path segment that is * alone now names any one segment. See GitHub: an App's tokens, branch limits and API budgets.