[FEAT]: Add support for Public Keys API

[colbylwilliams]

Describe the need

Add support for /meta/public_keys/<keyType>.

Secret Scanning and Copilot Extensions enable signature verification using public keys from the meta/public_keys API.

From secret scanning docs:

The HTTP request to your service will also contain headers that we strongly recommend using to validate the messages you receive are genuinely from GitHub, and are not malicious.

The two HTTP headers to look for are:

Github-Public-Key-Identifier: Which key_identifier to use from our API
Github-Public-Key-Signature: Signature of the payload
You can retrieve the GitHub secret scanning public key from https://api.github.com/meta/public_keys/secret_scanning and validate the message using the ECDSA-NIST-P256V1-SHA256 algorithm. The endpoint will provide several key_identifier and public keys. You can determine which public key to use based on the value of Github-Public-Key-Identifier.

SDK Version

No response

API Version

No response

Relevant log output

No response

Code of Conduct

• I agree to follow this project's Code of Conduct