Configure the @hackbot-mozilla GitHub App and secrets #7050

We already have a GitHub App with the handle @hackbot-mozilla. Configure it for hackbot and wire its credentials into our deployments.

• Set the App permissions needed by the other sub-issues: pull requests read/write, issues read/write (PR conversation comments), contents read/write (pushing branches), metadata read.
• Subscribe to webhook events and set the webhook URL and secret.
• Store the App ID, private key, and webhook secret in Secret Manager. Expose them to hackbot-api and the agent broker sidecar, never to the agent container.