fix(github): prevent redundant team fetches across multiple orgs

Fetch user teams once instead of per-org to prevent OAuth timeout.

Current implementation calls teamsForOrg() inside the org loop,
fetching ALL user teams repeatedly for each configured org. This
causes redundant API calls and OAuth code expiration for users
in many teams.

Example: 10 orgs, user in 150 teams
- Before: 10 × 5 pages = 50 API calls, 50s
- After: 1 × 5 pages = 5 API calls, 5s

Changed to call userOrgTeams() once before the loop, then use
cached results. The function already returns teams organized by
org, making this a simple and obvious optimization.

connector/github/github.go

@@ -343,6 +343,14 @@ func formatTeamName(org string, team string) string {
 func (c *githubConnector) groupsForOrgs(ctx context.Context, client *http.Client, userName string) ([]string, error) {
 	groups := make([]string, 0)
 	var inOrgNoTeams bool
+
+	// Fetch all user teams once to avoid redundant API calls across multiple orgs.
+	// This prevents fetching the same team data repeatedly when iterating through orgs.
+	allTeamsByOrg, err := c.userOrgTeams(ctx, client)
+	if err != nil {
+		return nil, fmt.Errorf("github: get teams: %v", err)
+	}
+
 	for _, org := range c.orgs {
 		inOrg, err := c.userInOrg(ctx, client, userName, org.Name)
 		if err != nil {
@@ -352,10 +360,9 @@ func (c *githubConnector) groupsForOrgs(ctx context.Context, client *http.Client
 			continue
 		}
 
-		teams, err := c.teamsForOrg(ctx, client, org.Name)
-		if err != nil {
-			return nil, err
-		}
+		// Use cached teams from the single fetch above instead of fetching per-org
+		teams := allTeamsByOrg[org.Name]
+
 		// User is in at least one org. User is authorized if no teams are specified
 		// in config; include all teams in claim. Otherwise filter out teams not in
 		// 'teams' list in config.