Promotion/Demotion actions should only appear for repo owners

[c-lliope]

In order to determine who is a repo owner,
we need to have users authenticate with GitHub.
The easiest way to do that is probably through the omniauth-github gem.

This will also let us get rid of the personal access tokens and ~/.netrc entries.