Don't require GitHub auth for public-repo PR status/label reads (#16210)

[helen229]

Summary

Fixes #16210.

SDK generation (and other release-plan operations) prompted users to authenticate with GitHub (gh auth login) even when the only thing being read was the status, checks, and labels of a public spec pull request. For a PR in the public azure-rest-api-specs repository this information is available anonymously, so requiring authentication was unnecessary and confusing.

Changes

• Added an anonymous GitHub client and a small ReadWithAnonymousFallbackAsync helper in GitConnection. Read-only operations are attempted anonymously first; only if GitHub signals that authentication is required (any Octokit.ApiException — private repo/404, forbidden/403, unauthorized/401, or rate limit) do they retry with an authenticated client, which prompts for gh auth login when no token is available.
• Switched the read-only public-PR operations (GetPullRequestAsync, GetPullRequestHeadSha, and the check-runs lookup in GetPullRequestChecksAsync) to use the helper.
• Added GitHubServiceTests covering: anonymous success (no auth attempted), retry-authenticated when anonymous is denied, and surfacing the auth prompt when no token is available.
• CHANGELOG entry under 0.6.25 Bugs Fixed.

Testing

dotnet test --filter "FullyQualifiedName~GitHubServiceTests|FullyQualifiedName~SpecWorkFlowToolTests" — all passing.

[Copilot]

Pull request overview

This PR updates the azsdk CLI’s GitHub access layer to avoid prompting users to authenticate (gh auth login) when performing read-only lookups against public repositories (notably public azure-rest-api-specs PRs during SDK generation). It introduces an anonymous-first read pattern with authenticated fallback and adds tests + a changelog entry to document the behavior change.

Changes:

• Added an unauthenticated GitHubClient plus a ReadWithAnonymousFallbackAsync helper to try public reads anonymously before falling back to authenticated access.
• Updated public read paths (GetPullRequestAsync, GetPullRequestHeadSha, check-runs lookup in GetPullRequestChecksAsync) to use anonymous-first behavior.
• Added GitHubServiceTests and documented the fix in the CLI changelog.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
tools/azsdk-cli/Azure.Sdk.Tools.Cli/Services/GitHubService.cs	Adds anonymous client + helper and routes key public PR read operations through anonymous-first access.
tools/azsdk-cli/Azure.Sdk.Tools.Cli/CHANGELOG.md	Documents the behavior change under 0.6.25 bug fixes.
tools/azsdk-cli/Azure.Sdk.Tools.Cli.Tests/Services/GitHubServiceTests.cs	Adds coverage for anonymous success, authenticated retry, and auth prompting when no token is available.