Start GitHub OAuth flow

Redirects the user to GitHub's authorization page. Sets an oauth_state cookie for CSRF protection. After authorization, GitHub redirects to /oauth/github/callback.

Requests scope read:user user:email (issue #390) — user:email lets the callback read GET /user/emails to discover GitHub's verified primary address for email adoption and sign-in merging (see /oauth/github/callback). Every account sees GitHub's consent screen once more on their next sign-in or link.