feat: add per-source token support

[masonlet]

Replaces the single global GITHUB_TOKEN with optional per-source tokens on GITHUB_USERNAMES and GITHUB_ORGS.

Changes

• Supports single value, CSV, or JSON array with optional per-entry tokens
• Graceful partial failure: one bad source skips rather than crashing
• Stale cache fallback on total fetch failure with 5-minute retry cooldown
• Pagination URL guard against malicious Link headers