feat: add REST-based MFA builtin spec for GitHub orgs

[deobieta]

Adds specs/github/mfa-rest.yaml, a REST-based alternative to the existing GraphQL mfa.yaml spec for checking MFA status in GitHub orgs.

• Queries orgs/${ORG}/members?filter=2fa_disabled via REST API
• Returns members without MFA enabled
• Produces predicateType http://github.com/carabiner-dev/snappy/specs/github/mfa-rest.yaml

Why not the existing GraphQL mfa.yaml

The GraphQL mfa.yaml uses the hasTwoFactorEnabled field on membersWithRole, which requires elevated token permissions not typically available in CI GitHub App setups. The REST endpoint orgs/{ORG}/members?filter=2fa_disabled achieves the same check with standard read:org scope, making it broadly compatible with GitHub App tokens used in CI pipelines.

[miniprow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: deobieta
Once this PR has been reviewed and has the lgtm label, a repository administrator can /approve this pull request. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from a repository administrator.

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment