CIP-18: remove hard OpenPGP dependency from go-github v30

[llebihan]

Summary

Backport the generic MessageSigner design from google#2935 onto the v30.1.0 maintenance base. This removes the hard golang.org/x/crypto/openpgp import that triggers GO-2026-5932 for downstream SDK consumers while preserving optional signing through a caller-supplied interface.

The fork exists solely to provide an immutable compatibility/security pin for LebtekOne while upstream ProjectDiscovery dependencies remain on go-github/v30.

Provenance

• Base: google/go-github v30.1.0
• Upstream design: Remove openpgp and change CreateCommit signature google/go-github#2935
• LebtekOne owner: CIP-18

Validation

• GOTOOLCHAIN=go1.27.0 GOWORK=off go test ./...
• GOTOOLCHAIN=go1.27.0 GOWORK=off go vet ./...
• Go 1.27 govulncheck: no reachable vulnerabilities
• Isolated LebtekOne scanner: go test ./..., go vet ./..., OpenAPI dependency contract, and govulncheck all pass with zero vulnerabilities

Do not merge without explicit approval.

[llebihan]

Downstream review: https://github.com/LebtekOrg/LebtekOne/pull/865 pins commit 1e7459df80cc6ae322fa347a0cc029b47fc2f078. The downstream PR is rebased onto current main and both required-ci and required-security are green, including all-module govulncheck and Syft/Grype. Both PRs remain open and unmerged pending explicit approval.