This commit introduces a fix for `GITHUB_TOKEN` being exposed to non-github hosts while in a codespace. We no longer return the `GITHUB_TOKEN` for any host except github.com and github.localhost while in a codespace (while the env var `CODESPACES` is `true`).

This commit also changes how tokens are returned when no oAuth token is found in a config. Previously, an empty string and the `oauthToken` source was returned. Now, we return an empty string and the `defaultSource` source. The intention behind this change is to make more logical sense by not returning an `oauthToken` source when we didn't get any token. It's also worth mentioning that this change also improves our test coverage - all lines in `tokenForHost` are now covered by tests, and we don't have unreachable code.

Co-authored-by: Kynan Ware <47394200+BagToad@users.noreply.github.com>

Co-authored-by: Kynan Ware <47394200+BagToad@users.noreply.github.com>

Prevent `tokenForHost` from leaking `GITHUB_TOKEN` to non-GitHub host in Codespaces