fix(observability): keep GitHub datasource credentials out of curl argv and child env

[JSONbored]

Summary

• scripts/setup-github-datasource.sh had the identical secret-leak pattern that PR fix(observability): avoid leaking Sentry setup secrets #5489 fixed in its sibling scripts/setup-sentry-datasource.sh: sourcing .env with set -a exported GITHUB_TOKEN/GRAFANA_ADMIN_PASSWORD into every child process's environment, curl -u "$AUTH" put GRAFANA_ADMIN_PASSWORD on the process argv (visible to any local user via ps aux), and -d "$(payload)" put the GitHub token in argv too.
• Applied the identical fix fix(observability): avoid leaking Sentry setup secrets #5489 shipped: drop set -a on the .env source (plain . ./.env), authenticate via a temporary permissioned netrc file with --netrc-file instead of -u "$AUTH", pipe the JSON payload to curl over stdin via --data-binary @- instead of -d "$(payload)", and wrap curl in a grafana_curl() helper that additionally does env -u GRAFANA_ADMIN_PASSWORD -u GITHUB_TOKEN as defense in depth.
• Idempotent update-vs-create behavior and the health check are unchanged.
• No dedicated test file existed for setup-github-datasource.sh before this PR (only two incidental cross-references from the Sentry script's own test file). Added test/unit/selfhost-grafana-github-datasource.test.ts with a regression test mirroring the one fix(observability): avoid leaking Sentry setup secrets #5489 added for the Sentry script, plus an executable-mode check and a behavior-preservation check (idempotent PUT/POST, secureJsonData/accessToken, health check all still present).

Scope

• In scope (scripts/, test/), narrow, single coherent change
• No secrets, tokens, or private terms added anywhere
• Mirrors an existing, already-open sibling PR's (fix(observability): avoid leaking Sentry setup secrets #5489) exact pattern — no new design decisions

Validation

• bash -n scripts/setup-github-datasource.sh — clean syntax
• npx vitest run test/unit/selfhost-grafana-github-datasource.test.ts test/unit/selfhost-grafana-sentry-datasource.test.ts — 12/12 passing
• npm run test:ci — full local gate green (794 test files / 15408 tests passed, 12 skipped)
• npm audit --audit-level=moderate — 0 vulnerabilities
• Confirmed behavior preserved: idempotent datasource GET/PUT/POST and health-check still run, secrets no longer in argv or inherited child environments

Safety

• No secrets in code/comments/tests
• Executable bit preserved (0o100, verified by the new test)
• scripts/ and test/ are Codecov-exempt per this repo's codecov.yml (src/** only) — no patch-coverage obligation, but ran the full gate anyway

Follow-up to #5489 (same author/account, same bug class, same fix pattern) — no separate tracking issue exists for this narrow mirrored fix, matching #5489's own precedent (also unlinked).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[JSONbored]

Closing as redundant — this is already shipped.

#5489 (merged) fixed the identical scripts/setup-sentry-datasource.sh secret-leak pattern and, in that same PR, applied the identical fix to this exact sibling script (scripts/setup-github-datasource.sh) plus added its first-ever dedicated test file (test/unit/selfhost-grafana-github-datasource.test.ts) — both already on main. This PR's diff is functionally the same change against the same two files, just opened independently around the same time, and now conflicts with the already-merged version (both add a new test file at the identical path with overlapping but non-identical content).

Good find either way — no action needed, already covered.