Add allowedInstallationIds list to each github app

This allows a single instance of backstage to optionally limit the set of
github app installations that may be used by backstage.

Previously, if you had github app installations for tenant1 and tenant2
there was nothing stopping the first from accessing resources of the
second.

The default behaviour of the GithubCredentialsProvider remains the same.

Signed-off-by: Brian Fletcher <brian@roadie.io>

docs/plugins/github-apps.md

@@ -84,3 +84,23 @@ integrations:
       apps:
         - $include: example-backstage-app-credentials.yaml
 ```
+
+### Limiting the Github App installations
+
+If you want to limit the Github app installations visible to backstage you
+may optionally include the `allowedInstallationIds` option.
+
+```yaml
+appId: 1
+allowedInstallationIds: [1234]
+clientId: client id
+clientSecret: client secret
+webhookSecret: webhook secret
+privateKey: |
+  -----BEGIN RSA PRIVATE KEY-----
+  ...Key content...
+  -----END RSA PRIVATE KEY-----
+```
+
+This will result in backstage preventing the use of any installation that is not within the
+allow list.