Don't update httpClient passed to NewClient

[WillAbides]

Users can accidentally leak credentials by doing something like this:

pat:=os.Getenv("GITHUB_TOKEN")
httpClient:=&http.Client{
Timeout: time.Second*30,
}
ghClient:=github.NewClient(httpClient).WithAuthToken(pat)
// ... do something with ghClienthttpClient.Get("https://some-sketchy-site")

This PR fixes that by updating NewClient to make a copy of httpClient so that when its transport is updated by WithAuthToken, the original httpClient won't have its transport updated as well.

It also updates TestWithAuthToken to check for leaks

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (062b611) 97.91% compared to head (593c130) 97.89%.

Additional details and impacted files

@@ Coverage Diff @@## master #3011 +/- ##
==========================================
- Coverage 97.91% 97.89% -0.03% 
==========================================
Files 150 150 Lines 12980 12984 +4 ==========================================
+ Hits 12710 12711 +1 - Misses 192 194 +2 - Partials 78 79 +1 

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[gmlewis]

Thank you, @WillAbides !
LGTM.

Awaiting second LGTM+Approval from any other contributor to this repo before merging.

[valbeat]

LGTM!

[gmlewis]

Thank you, @valbeat !
Merging.