feat(rhodibot): GitHub App authentication and a GraphQL client

rhodibot could not act as a GitHub App: the only credential it understood was a
single-repository GITHUB_TOKEN. This adds the RS256 JWT signing, the
installation-token exchange and cache, and a GraphQL client for the check runs
and issues the bot writes.

ring and base64 are taken at versions already in Cargo.lock, so the dependency
graph gains no new packages - which matters because CI builds with --locked.

Verified locally with rustc 1.98.1: fmt clean, clippy -D warnings clean,
95 tests pass, including 12 new wiremock tests covering the handshake, token
caching and refresh, and the GraphQL error paths.

Author: hyperpolymath

bots/rhodibot/Cargo.lock

@@ -30,6 +30,15 @@ serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.150"
 toml = "1.1.2+spec-1.1.0"
 
+# Crypto for GitHub App JWT signing (RS256).
+#
+# `ring` and `base64` are deliberately taken from versions already present in
+# Cargo.lock via rustls/reqwest, so this adds no new package to the graph --
+# which matters because CI builds with `--locked` and a regenerated lock would
+# otherwise have to be trusted sight-unseen.
+ring = "0.17"
+base64 = "0.22"
+
 # Crypto for webhook verification
 hmac = "0.13.0"
 sha2 = "0.11.0"