Add github_code_security_configuration resource

[mushhzz]

Resolves #2412

---

Before the change?

• There is no way to manage Code Security Configurations with this provider; they must be managed via the UI/API.

After the change?

• New github_code_security_configuration resource with full CRUD + import.
• Works at the organization level (default, using the provider owner) or the enterprise level via an optional enterprise_slug (ForceNew).
• Manages the feature toggles (advanced_security, dependency_graph, dependabot_alerts, dependabot_security_updates, code_scanning_default_setup, secret_scanning + push_protection/validity_checks/non_provider_patterns, private_vulnerability_reporting) and enforcement.
• default_for_new_repos drives the /code-security/configurations/{id}/defaults endpoint; attach_scope is a write-only attribute driving /attach (the API does not expose the attach scope, so it cannot be read back — this is documented on the attribute).
• Import: <configuration_id> for org-level, <enterprise_slug>:<configuration_id> for enterprise-level.
• Uses the code security configuration methods already present in go-github v89 (Organizations.*CodeSecurityConfiguration*, Enterprise.*CodeSecurityConfiguration*); no SDK bump.

Deliberately deferred to keep the initial resource small (happy to follow up): code_scanning_default_setup_options, dependency_graph_autosubmit_action(_options), delegated bypass/dismissal options, secret_scanning_generic_secrets, and the code_security/secret_protection bundle toggles.

Testing done:

• Manually verified end-to-end against a live enterprise: create, read/plan idempotency, update, delete, and import (both ID formats) all behaved as expected.
• Acceptance tests added (org create/update/import gated on org modes; enterprise create/update/import gated on enterprise mode). They need live credentials, so they have not run in CI here.
• make test, go vet, gofmt, and golangci-lint run are clean; docs regenerated with make generatedocs.

Per the contribution guidelines' AI policy: this PR was developed with AI assistance (Claude); I have reviewed the code and manually verified the behaviour end-to-end as described above.

Pull request checklist

• Schema migrations have been created if needed (example) (not needed — new resource)
• Tests for the changes have been added (for bug fixes / features)
• Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

• Yes
• No

[github-actions]

👋 Hi, and thank you for this contribution!

This repo is maintained by GitHub and community members on a best-effort basis. We'll get to this as soon as we can.

You can help us prioritize by joining the discussion on open issues and PRs, sharing details on the changes you need, and reviewing other contributions.

---

_{🤖 This is an automated message.}

[Copilot]

Pull request overview

These provider review instructions are being used. Adds organization- and enterprise-level GitHub Code Security Configuration management. Blocking reliability and test issues are noted inline.

Changes:

• Adds full CRUD and import support.
• Registers the resource and adds acceptance tests.
• Adds examples and generated documentation.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
github/resource_github_code_security_configuration.go	Implements schema, CRUD, import, defaults, and attachment behavior.
github/resource_github_code_security_configuration_test.go	Adds organization and enterprise acceptance tests.
github/provider.go	Registers the resource.
examples/resources/code_security_configuration/example_1.tf	Demonstrates typical usage.
templates/resources/code_security_configuration.md.tmpl	Defines documentation content.
docs/resources/code_security_configuration.md	Adds generated resource documentation.

[mushhzz]

Thanks for the Copilot review — really useful pass! I've addressed the feedback in 5e15072:

• Context-aware CRUD: migrated to CreateContext/ReadContext/UpdateContext/DeleteContext with diag.Diagnostics, threading the provided context through all API calls. Create now sets its computed fields directly rather than chaining Read.
• Logging: all stdlib log calls replaced with structured tflog per DECISIONS.md.
• Delete: a 404 is now treated as already-deleted, so terraform destroy succeeds if the configuration was removed out-of-band.
• Attach path: swapped the go-github v89 attach helpers (which can nil-deref on transport failures) for a nil-safe direct client.NewRequest/client.Do call; that helper issue looks worth an upstream go-github report.
• Tests: all steps converted to ConfigStateChecks + statecheck/knownvalue/plancheck per DECISIONS.md, and added new acceptance coverage for default_for_new_repos (set → change → remove → empty plan) and attach_scope (set + idempotent re-plan).

The one comment I didn't action is the new(d.Get(...).(string)) one — Go 1.26 (declared in go.mod) allows new(expr), and the repo already uses this idiom elsewhere; details in the thread reply.

make test, go vet, gofmt, and go build are all clean after the changes. Happy to adjust anything further!