[ews] Implement Login with GitHub on EWS

https://bugs.webkit.org/show_bug.cgi?id=235829
<rdar://problem/88192177>

Reviewed by Jonathan Bedard.

References:
https://docs.buildbot.net/latest/developer/auth.html
https://docs.buildbot.net/current/manual/configuration/www.html#authorization-rules

* Tools/CISupport/ews-build/master.cfg:

Canonical link: https://commits.webkit.org/260531@main

Tools/CISupport/ews-build/master.cfg

@@ -60,16 +60,20 @@ if not is_test_mode_enabled:
         },
     )
 
-    credentials = load_password('EWS_CREDENTIALS')
-    if not credentials:
-        print('EWS credentials not found. Please ensure EWS_CREDENTIALS is configured either in env variables or in passwords.json')
+    GITHUB_CLIENT_ID = load_password('GITHUB_CLIENT_ID')
+    GITHUB_CLIENT_SECRET = load_password('GITHUB_CLIENT_SECRET')
+    if (not GITHUB_CLIENT_ID) or (not GITHUB_CLIENT_SECRET):
+        print('EWS credentials not found. Please ensure GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET are configured either in env variables or in passwords.json')
         sys.exit(1)
+
     # See https://docs.buildbot.net/current/manual/configuration/www.html#example-configs
     authz = util.Authz(
-        allowRules=[util.AnyControlEndpointMatcher(role="admin")],
-        roleMatchers=[util.RolesFromEmails(admin=list(credentials.keys()))]
+        allowRules=[util.AnyEndpointMatcher(role='Buildbot-Administrators', defaultDeny=False),
+                    util.RebuildBuildEndpointMatcher(role='Contributors'),
+                    util.AnyControlEndpointMatcher(role='Buildbot-Administrators')],
+        roleMatchers=[util.RolesFromGroups(groupPrefix='WebKit/')]
     )
-    auth = util.UserPasswordAuth(credentials)
+    auth = util.GitHubAuth(GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, apiVersion=4, getTeamsMembership=True, debug=True)
     c['www']['auth'] = auth
     c['www']['authz'] = authz