fix: include GitHub Enterprise internal repositories in scans

[ai-anant]

Summary

Fixes #6 — GitHub Enterprise (Server/Cloud) organizations can have internal repositories (visible to all enterprise members, but not public). The org/user scan pipeline silently skipped them.

Root cause

In js/github-client.js, getRepositories() filtered every repository list with:

const isPublic = repo.visibility === 'public';

• Org path (GET /orgs/{owner}/repos, line ~764): repos with visibility: 'internal' were dropped, even when the configured token had access to them.
• User REST path (GET /users/{owner}/repos, line ~823): same filter.

The GitHub API only returns internal repos to authenticated callers with access, so unauthenticated scans are unaffected (they never see internal repos in the response). Internal visibility is org-owned on GitHub Enterprise; the user path change is for parity.

Changes

• js/github-client.js: org + user REST filters now accept public or internal visibility.
• js/app.js: the "No public repositories found" alert reworded to "No public or internal repositories found".
• CHANGELOG.md: entry added under [Unreleased] → Fixed (per repo policy, every change is recorded).

Notes / limitations

• Fetching an SBOM for an internal repo still requires a token with access to that repo; existing fetchSBOM 401/403 handling covers the failure case gracefully.
• The app's API base URL is hardcoded to https://api.github.com — pointing the app at a GitHub Enterprise Server instance (different API host) is a separate feature, not addressed here.
• The GraphQL user path hardcodes visibility: 'public'; user-owned repos cannot be internal, so this is not a functional gap.

Verification

• node --check js/github-client.js ✅
• node --check js/app.js ✅
• No files added/removed → validate-deployment.yml file-presence checks unaffected.

Fixes #6