Add create-github-app-token plugin implementation - #1

Why

Buildkite users need a first-party equivalent to actions/create-github-app-token that can securely create short-lived GitHub App installation tokens without embedding private keys in pipeline configuration.

What

• adds a dependency-light Buildkite plugin that signs a short-lived JWT, discovers or accepts an installation, and requests repository- and permission-scoped tokens
• accepts private keys only through Buildkite Secret or environment-variable references, registers tokens for redaction before export, and supports GitHub Enterprise Server
• revokes tokens in pre-exit by default, with fail-closed handling and cleanup for temporary key and token state
• documents least-privilege usage and includes CI plus automated coverage for creation, scoping, redaction, failures, revocation, and cleanup