Retry GitHub App token requests on transient TLS failures

[cursor]

Summary

• add bounded retries when minting GitHub App installation access tokens
• retry only transient network/TLS failure classes (SSLError, ConnectionError, Timeout) with linear backoff
• add explicit request timeouts to both token create and token revoke calls to avoid hanging worker threads
• add focused unit tests covering retry success, retry exhaustion, and non-retryable HTTP errors

Root Cause

Sentry issue SENTRY-GITHUB-ACTIONS-APP-70 shows failures in GithubAppToken.get_token when calling GitHub's installation token endpoint, caused by transient TLS EOF handshake errors. The previous implementation used a single requests.post without timeout or retries, so temporary upstream network flakiness immediately surfaced as 500 responses.

Validation

• python3 -m pytest tests/test_github_app.py tests/test_web_app_handler.py tests/test_github_sdk.py
• result: 18 passed, 1 skipped

Risk

Low. Change is tightly scoped to GitHub App token minting/revocation request behavior and does not alter successful request flow or authentication semantics.