sync: only reset tokens on Sundays

When the token is reset, the old token is immediately revoked. This
means that any part of our code that uses a GitHub OAuth token can get
it from the database and then before actually using it, it could be
revoked. Until our code handles this better, we should limit how often
we cycle tokens, and Sunday was picked as a day with less activity so
less chance for collisions.