chore(backend): GitHub token should be a SecretStr

[amanape]

End-user friendly description of the problem this fixes or functionality that this introduces
Instead of simply being type str, it should be SecretStr like the llm_api_key

• Include this change in the Release Notes. If checked, you must provide an end-user friendly description for your change below

---

Give a summary of what the PR does, explaining any non-trivial design decisions

• GitHub token in type SecretStr
• Rename / introduce setting model variants: GETSettingsModel and POSTSettingsModel

---

Link of any specific issues this addresses

---

To run this PR locally, use the following command:

docker run -it --rm   -p 3000:3000   -v /var/run/docker.sock:/var/run/docker.sock   --add-host host.docker.internal:host-gateway   -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:29ba709-nikolaik   --name openhands-app-29ba709   docker.all-hands.dev/all-hands-ai/openhands:29ba709

[enyst]

Was llm_api_key converted too?

[amanape]

Good question. I've had to do this here since this was the first instance where we receive and use github_token but need it to be a SecretStr. I think llm_api_key is secret-ed via the serializer but I'm not certain. If it is, then maybe I can do the same with the github_token but I encountered a bunch of issues when I tried.

I'll wait for @tofarr to confirm

[tofarr]

llm_api_key was previously converted to a secret str - but github token was added as a regular str after this was done and needed the same conversion.

[tofarr]

Actually, I don't think the secret key conversion is strictly needed for either here - since the constructor for Settings will do the conversion if needed

[tofarr]

from openhands.server.settings import Settings
Settings(llm_api_key='foobar')

>>> Settings(language=None, agent=None, max_iterations=None, security_analyzer=None, confirmation_mode=None, llm_model=None, llm_api_key=SecretStr('**********'), llm_base_url=None, remote_runtime_resource_factor=None, github_token=None, enable_default_condenser=False)

[tofarr]

    filtered_settings_data['github_token'] = settings_with_token_data.github_token

[enyst]

Can we make a unit test with both, to see it works as expected?

[enyst]

Thank you! Just a couple little questions

[tofarr]

LGTM - the only nit I have is that we don't need that explicit conversion