Make the searched GitHub owners configurable and stop flooding the API

[Philipp0205]

Problems

Three failures in the connection test, all from the same place: listing pull requests across every repository a token can reach.

A scope the token may not search aborted the whole listing.

OK       Authentication
         Authenticated as Philipp0205
FAILED   Read pull requests
         GitHub API request failed: HTTP 422 - {"message":"Validation Failed","errors":[{"message":"The listed users and repositories cannot be searched either because the resources do not exist or you do not have permission to view them.",...}],"status":"422"}

GitHub answers GET /search/issues with HTTP 422 as soon as one qualifier names something the token may not search, which happens for organizations the token was never SSO-authorized for, private repositories when the token lacks the repo scope, and repositories renamed since they were listed. One rejected scope threw out of the loop and killed the listing.

The API rate limit ran out.

OK       Authentication
         Authenticated as philipp-kurrle_ADVNTST
FAILED   Read pull requests
         GitHub API request failed: HTTP 403 - {"message":"API rate limit exceeded for user ID 201185819. ...","status":"403"}

The listing sent one search per owner scope and then read every pull request any of those searches returned, one request each, before sorting and cutting the result down to the requested page. A token reaching 60 repositories spent 660 requests on a single refresh.

No control over which account's pull requests appear. Which pull requests show up is decided entirely by the account the token belongs to, and there was no way to narrow that down. A token issued by the philipp-kurrle_ADVNTST account lists that account's world, not Philipp0205's.

Changes

• Search only preference. Lists the owners and repositories to search. When set, the plugin searches exactly those and skips discovering organizations and collaborator repositories entirely. A bare name covers everything a user or organization owns; owner/name covers a single repository. Verified against the live API that user: matches organizations too, so one entry form works for both.
• Page the search results before reading them. The search response already reports each pull request's updated_at, so results from all scopes are merged, ordered and cut to the requested page first, and only that page is read in full.
• Batch owner scopes into shared queries. GitHub combines repeated qualifiers of the same kind with OR, so up to 20 scopes go into one request. A batch GitHub refuses is retried scope by scope, so only the genuinely unsearchable scope is dropped.
• Skip refused scopes instead of failing. GitHubPullRequestSearch records them, and the connection test reports them as a warning naming the scope. The listing fails only when no scope is searchable, and then the message names the scopes and the token requirement.
• Recognize rate limiting. A throttled response aborts the listing with an explanation and a pointer to the new preference rather than the raw JSON, and the remaining scopes are not retried into the same wall. Failures that are neither refusals nor throttling (5xx, network errors) still propagate immediately, so an outage is never silently turned into a partial list.
• /user/orgs and /user/repos failures degrade to an empty scope list with a log warning, so a token without read:org no longer hides the user's own pull requests.

Testing

mvn clean verify — 165 tests pass, 34 of them new. GitHubConnectionTest drives the real GitHubClient against a local stub API that reproduces the reported 422 and 403 bodies and counts every request the client sends.

Requests to list 100 pull requests for a token reaching 60 repositories, each search matching 600 pull requests, measured against the stub:

	searches	detail reads	total
Before	60	600	660
After	3	100	103

With Search only set to a single owner, the client sends exactly one search request and never calls /user, /user/orgs or /user/repos.

Connection test report for a refused scope, before and after:

OK       Authentication
         Authenticated as Philipp0205
FAILED   Read pull requests
         GitHub API request failed: HTTP 422 - {"message":"Validation Failed","errors":[{"message":"The listed users and repositories cannot be searched either because the resources do not exist or you do not have permission to view them.","resource":"Search","field":"q","code":"invalid"}],"status":"422"}

OK       Authentication
         Authenticated as philipp-kurrle_ADVNTST
OK       Read pull requests
         Returned 1 pull request(s)
WARNING  Search scopes
         GitHub refused to search org:acme.
         Use a classic personal access token with the 'repo' and 'read:org' scopes, and authorize it for every organization that enforces SAML single sign-on. Fine-grained tokens can only search the repositories they were granted.

And for the rate limit:

OK       Authentication
         Authenticated as philipp-kurrle_ADVNTST
FAILED   Read pull requests
         The GitHub API rate limit for this access token is exhausted. Wait for the limit to reset, or search fewer repositories by listing the wanted owners on the pull request preference page. GitHub API request failed: HTTP 403 - {"message":"API rate limit exceeded for user ID 201185819.","status":"403"}