refactor: add credential and Git packages (#1123)

- `internal/auth`: credentials in the OS keyring or a private file, OAuth login with token refresh, SSH HTTP-signature signers (key files with passphrase prompt, ssh-agent keys and certificates), and the Git credential helper protocol.
- `internal/git`: cancellable Git subprocesses, repository and remote discovery (tracked remote via `branch.<name>.remote`), PR checkout by full ref, AGit push, branch cleanup.

Nothing imports these packages yet.

Reviewed-on: https://gitea.com/gitea/tea/pulls/1123
Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>

internal/git/ssh.go

@@ -0,0 +1,24 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package git
+
+import (
+	"errors"
+	"strings"
+
+	"github.com/kballard/go-shellquote"
+)
+
+// SSHArguments selects a private key for one Git operation. Agent selection
+// retains the user's SSH configuration, as does an account without a key.
+func SSHArguments(key string, agent bool) ([]string, error) {
+	if strings.ContainsAny(key, "\x00\r\n") {
+		return nil, errors.New("SSH key path cannot contain NUL or line breaks")
+	}
+	if agent || key == "" {
+		return nil, nil
+	}
+	command := shellquote.Join("ssh", "-i", key, "-oIdentitiesOnly=yes", "-oIdentityAgent=none")
+	return []string{"-c", "core.sshCommand=" + command}, nil
+}