fix(devtools): skip what a private repository's plan does not offer

[davidmoralesz]

What changed, and why

Closes #56.

repo-settings.sh stopped at the first private repository. On the Free plan GitHub refuses a private repository's rulesets with a 403; the script exited 1 there, which --check callers (github-setup.sh in the projects) read as "differs", and an org-wide apply never reached the repositories after it.

• Skips, with a note: rulesets, secret scanning and private vulnerability reporting, when GitHub does not offer them to the repository. A skip is not a difference and does not change the exit code.
• Secret scanning is left out of the settings request when the repository reports security_and_analysis: null, because it travels in the same PATCH as the merge settings.
• Exit 2 for failures: every read now goes through one helper that keeps the HTTP status, and anything unexpected exits 2, so 1 only ever means "differences found". A 403 that is not the plan message is still an error.
• No error body in the report: the {"message":"Not Found",…} that leaked into the private vulnerability reporting line is gone.
• A test, .devtools/test-repo-settings.sh, run by self-lint. It uses a stand-in for gh, so it needs no token.

Not a breaking change for consumers: the arguments and the output layout are the same, and exit codes 0 and 1 mean what they did.

How it was tested

• bash .devtools/test-repo-settings.sh: 23 checks pass. Against the script on main, 17 of them fail.

• Read-only, against the real repositories:

  $ bash .devtools/repo-settings.sh --check zero-trust datapacks tallyhopper .github
  studiobimo/zero-trust
      ! secret scanning: not offered to this repository on its plan (skipped)
      settings
        allow_update_branch: false -> true
        delete_branch_on_merge: false -> true
      vulnerability alerts: false -> true
      automated security fixes: false -> true
      ! private vulnerability reporting: not offered to this repository on its plan (skipped)
      ! rulesets: not offered to this repository on its plan (skipped)
  studiobimo/datapacks
      ✔ in step
  studiobimo/tallyhopper
      ✔ in step
  studiobimo/.github
      ruleset checks-dotgithub
        ...
  

• shellcheck and the lefthook pre-commit hooks pass.

• Not tested: applying to a real private repository. Only --check was run against GitHub. The apply path on a private repository is covered by the stand-in alone, so whether GitHub accepts the remaining settings there is unconfirmed until someone runs it.

The run above also shows .github's own checks-dotgithub ruleset is out of step with rulesets/checks-dotgithub.json (the lint / lefthook check is not on the repository yet). That predates this change and is not touched here.

Checklist

• Title is a Conventional Commit;
  branch follows Conventional Branch
• At most 20 files changed (split with gh stack if not)
• Third-party uses: pinned to a full SHA with a # vX.Y.Z comment
• Our own actions referenced with $/ from a workflow, SHA-pinned from a template
  (sh .devtools/check-action-pins.sh)
• permissions: {} at workflow level; each job asks for the least it needs
• Breaking change for consumers is called out above, since they ride the floating v1