Move sensitive GitHub API out of server config

For enhanced security, this secret is now in a separate, one-line file
that's not stored in the code repository, like the existing
'janrain.key' file. Both of these files should now be stored in the
main 'deploy' directory, alongside *.pem and other sensitive stuff.

At runtime, the GitHub client secret is merged into the main config
object in web2py, so downstream code doesn't need to be changed.