fix: authenticate and harden the GitHub integration OAuth flow (#981)