Have CollectOSS declare (via a user agent header) itself in API calls to github

[MoralCode]

I suspect we arent currently doing this and it might help github identify traffic from our tooling (so we pass through bot detection better and/or so someone at github can report issues to us if we need to tweak the way we hit github's API).

This might be a good "challenging first issue" for someone

I think the user agent we pick should include:

• project name (CollectOSS)
• maybe a mention of CHAOSS/Linux foundation
• a link to this github repo
• ideally also the version number of CollectOSS

[c4lliope]

Can we use the running program's domain name inside the user agent?
If someone runs a copy of collectoss unaffiliated with Linux
(e.g. someone modifies the rate-limit in their copy),
this could explain to GitHub that they are unaffiliated with collectoss.org.

Perhaps:
CollectOSS/1.1.0 (github:chaoss/collectoss) collectoss.org (Linux Foundation CHAOSS group)

In this sample, the 2 final IDs are pulled from environment variables.

[MoralCode]

Can we use the running program's domain name inside the user agent?

We dont currently have a need for the CollectOSS app to know what networking environment it is in/whether its exposed via a domain. I suspect we may have a need to know at some point if the API ever returns fully qualified URLs to itself, but I haven't looked too much at that part of the code yet to know for sure.

Either way though, this is just an informational field that anyone can change - if github is relying on the user agent field for substantial API filtering, then they probably have bigger issues. IMO making our user agent work this way to try and vouch for the legitimacy of an instance in a field that anyone can change is probably more effort than its worth.

I see this change as more of a courtesy than anything else. If someone has a reason to care about us and what we are doing, then this change helps direct them towards the source code/maintainers more easily if they want to analyze things for themselves or reach out. Overall i'm not too worried about someone trying to remove the rate limits - all theyll do is cause exceptions and collection task failures. If someone decides to use our software to hit the github API too hard, github (and i hope any competent software with a REST API) already has tools (revoking API keys, IP bans, etc) to limit the damage.

Aside from github too, I think this courtesy could really help once we start rolling out support for multiple forge instances and other forges like Foregejo. Then we will be collecting against instances that are much smaller and may be more sensitive to the loads that our collection puts on them (or maybe they just get curious from their logs and become contributors).

Honestly, i think id be fine with essentially just hardcoding what you had written and injecting the version number (known issue #251)