Add tokensource library

[wlynch]

Adds library to make it easy to create a oauth2.TokenSource for use with GitHub clients.

[imjasonh]

Actually I'd probably not use a library that pulls in k8s deps just to get this in tf-common. Plus it depends on tf-common itself 😆

Any chance we could make an octo-sts/client repo? 🤷

[wlynch]

I'm for that.

@mattmoor objections?

[mattmoor]

I'm missing something, what's the K8s dep?

[wlynch]

I think jason is referring to the deps in go.mod for the server components. IIIUC even though the Go tool is smart enough to not include them in produced binaries if they're unused, they'll still show up in go.mod of dependencies as indirect and you'll need to dependabot bump them regularly.

[mattmoor]

I see a single line in the entire repo using the API machinery sets which could simply use something else, and I am not sure that sigs.k8s.io/yaml is anything to be worried about (I believe it's a fork of another yaml package to support json annotations, so I think it's well scoped/contained).