Add support for GitHub Enterprise Server (GHES) custom API URLs

[felickz]

Feature Request

What would you like to be added:

Support for GitHub Enterprise Server (GHES) with custom API URLs. The action should detect or accept a custom GitHub API base URL so it can communicate with GHES instances instead of only github.com.

Why is this needed:

Currently, the getClient function in src/github/GithubClient.ts calls github.getOctokit(githubToken, ...) without passing a baseUrl option, meaning all API requests are hardcoded to https://api.github.com. Organizations running GHES cannot use features like dependency snapshot uploads or release asset management through this action because the API calls will never reach their GHES instance.

GHES runners already expose GITHUB_API_URL and GITHUB_SERVER_URL environment variables with the correct endpoints. The action should either:

1. Automatically read GITHUB_API_URL and pass it as baseUrl to getOctokit, or
2. Expose an optional github-url input parameter that overrides the default API endpoint.

Additionally, the Syft download logic in SyftDownloader.ts hardcodes github.com URLs, which would fail on air-gapped GHES environments without access to the public internet.

Additional context:

• The @actions/github getOctokit function supports a baseUrl option for GHES compatibility.
• GHES runners automatically set GITHUB_API_URL (e.g., https://ghes.example.com/api/v3) and GITHUB_SERVER_URL (e.g., https://ghes.example.com).
• A minimal fix would be:

  const octokit = github.getOctokit(githubToken, {
    baseUrl: process.env.GITHUB_API_URL || "https://api.github.com",
    // ...existing options
  });

• For air-gapped environments, consider supporting a syft-path input to allow users to provide a pre-installed Syft binary, bypassing the download from github.com entirely.