Don't update httpClient passed to NewClient

[WillAbides]

Users can accidentally leak credentials by doing something like this:

pat := os.Getenv("GITHUB_TOKEN")
httpClient := &http.Client{
	Timeout: time.Second * 30,
}
ghClient := github.NewClient(httpClient).WithAuthToken(pat)

// ... do something with ghClient

httpClient.Get("https://some-sketchy-site")

This PR fixes that by updating NewClient to make a copy of httpClient so that when its transport is updated by WithAuthToken, the original httpClient won't have its transport updated as well.

It also updates TestWithAuthToken to check for leaks

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (062b611) 97.91% compared to head (593c130) 97.89%.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3011      +/-   ##
==========================================
- Coverage   97.91%   97.89%   -0.03%     
==========================================
  Files         150      150              
  Lines       12980    12984       +4     
==========================================
+ Hits        12710    12711       +1     
- Misses        192      194       +2     
- Partials       78       79       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[gmlewis]

Thank you, @WillAbides !
LGTM.

Awaiting second LGTM+Approval from any other contributor to this repo before merging.

[valbeat]

LGTM!

[gmlewis]

Thank you, @valbeat !
Merging.