feat(github): pull request tool window, timeline and review flow (#477)

Replaces the Pull Requests tool window with a full review workflow on top of gh's authentication.

- List with search, quick filters and paging; a tab per pull request and a New Pull Request tab.
- Details: commit picker, changes tree with viewed state, CI and reviewer status, merge, close and reopen.
- Timeline editor: comments, review threads, reactions and suggested changes.
- Review in the diff viewer and, for the checked-out branch, in the editor (review mode).
- New generic vcs extension points: registerDiffViewerProvider, lineInlays, reviewGutter, branch widget extensions; new vcs_merge_base and gh_api commands.
- CSP: img-src allows https://avatars.githubusercontent.com for avatars.

Fixed while testing against a real repository: remotes behind an SSH host alias, mergeability stuck on UNKNOWN, Apply Locally staying disabled after a checkout, relative links navigating the app's page, and review inlays wider than the pane.

Co-authored-by: imacross <[email protected]>

crates/ide-github/tests/parse.rs

@@ -22,6 +22,7 @@ fn pr_view() {
     assert_eq!(pr.summary.number, 14768);
     assert_eq!(pr.summary.head_ref, "babakks/refresh-token-bump-deps");
     assert_eq!(pr.head_oid, "6ec1ba54542baca6cc5932582634104c83f36a28");
+    assert_eq!(pr.merge_state_status, "UNKNOWN");
     assert_eq!(pr.files.len(), 2);
     assert_eq!(pr.files[0].change_type, "MODIFIED");
     assert_eq!(pr.commits[0].headline, "chore(deps): bump github.com/cli/oauth to v1.3.0");
@@ -69,6 +70,16 @@ fn repo_view() {
         .unwrap();
     assert_eq!(r.name_with_owner, "l0ng-ai/openidea");
     assert_eq!(r.default_branch.as_deref(), Some("main"));
+    assert!(r.merge_commit_allowed && r.squash_merge_allowed && r.rebase_merge_allowed, "unknown: allowed");
+    assert_eq!(r.viewer_permission, "");
+
+    let r = parse_repo(
+        r#"{"mergeCommitAllowed":true,"nameWithOwner":"o/r","url":"","rebaseMergeAllowed":false,"squashMergeAllowed":false,"viewerPermission":"WRITE"}"#,
+    )
+    .unwrap();
+    assert!(r.merge_commit_allowed);
+    assert!(!r.squash_merge_allowed && !r.rebase_merge_allowed);
+    assert_eq!(r.viewer_permission, "WRITE");
 }
 
 #[test]
@@ -87,3 +98,24 @@ fn list_arguments() {
     assert!(joined.contains("--limit 500 --state merged --author @me"));
     assert_eq!(args.last().map(String::as_str), Some("review-requested:@me fix login"));
 }
+
+#[test]
+fn api_arguments() {
+    let req =
+        GhApiRequest { method: "post".into(), endpoint: "graphql".into(), body: Some("{}".into()), paginate: false };
+    assert_eq!(api_args(&req).unwrap(), ["api", "--method", "POST", "graphql", "--input", "-"]);
+    let req = GhApiRequest {
+        method: "GET".into(),
+        endpoint: "repos/{owner}/{repo}/labels".into(),
+        body: None,
+        paginate: true,
+    };
+    assert_eq!(
+        api_args(&req).unwrap(),
+        ["api", "--method", "GET", "repos/{owner}/{repo}/labels", "--paginate", "--slurp"]
+    );
+    for bad in ["--hostname", "https://evil.example/x", ""] {
+        assert!(api_args(&GhApiRequest { endpoint: bad.into(), ..req.clone() }).is_err(), "{bad}");
+    }
+    assert!(api_args(&GhApiRequest { method: "TRACE".into(), ..req }).is_err());
+}