Use GitHub avatar if no vendor logo is available.

Do not merge!

If you agree to the changes, I will first re-try the update locally and if it really really really 1000% works, we can push to zikula.org.
Ok - after digging through this, it turned out that the solution for all the security concerns is to check whether or not a user has push access to an Extension based on `$repositoryId` and not `foo/bar` repository name.