fix(github): address review findings from rounds 2867/2870

- Extract duplicated CheckRedirect lambda to defaultCheckRedirect function
  (sonnet #1: eliminate duplication between NewClient and SetHTTPClient)
- Remove unnecessary int64 cast in response size check (sonnet #3)
- Validate fallback unmarshal in ListContents to reject zero-value entries
  (sonnet #5: prevent accepting unexpected JSON formats silently)
- Rename strPtr to stringPtr for consistency (sonnet #6)
- Add doc comment about APIError.Error body exposure (security #3)

Deferred to separate issues:
- #95: Reject cross-host redirects entirely (security #1)
- #96: Add safeguards for AllowInsecureHTTP (security #2)

github/pr_test.go

@@ -528,13 +528,13 @@ func TestGetCommitStatuses_CheckRunConclusions(t *testing.T) {
 		status     string
 		want       string
 	}{
-		{strPtr("success"), "completed", "success"},
-		{strPtr("failure"), "completed", "failure"},
-		{strPtr("action_required"), "completed", "failure"},
-		{strPtr("timed_out"), "completed", "failure"},
-		{strPtr("cancelled"), "completed", "success"},
-		{strPtr("skipped"), "completed", "success"},
-		{strPtr("neutral"), "completed", "success"},
+		{stringPtr("success"), "completed", "success"},
+		{stringPtr("failure"), "completed", "failure"},
+		{stringPtr("action_required"), "completed", "failure"},
+		{stringPtr("timed_out"), "completed", "failure"},
+		{stringPtr("cancelled"), "completed", "success"},
+		{stringPtr("skipped"), "completed", "success"},
+		{stringPtr("neutral"), "completed", "success"},
 		{nil, "in_progress", "pending"},
 		{nil, "queued", "pending"},
 	}
@@ -632,6 +632,6 @@ func TestGetCommitStatuses_MalformedJSON(t *testing.T) {
 	}
 }
 
-func strPtr(s string) *string {
+func stringPtr(s string) *string {
 	return &s
 }