fix: follow-up fixes for conditional VCS requests (#27711)

Follow-ups from #27627 

- Memoizes `Config.Git()` with a mutex so the provider's ETag response
cache survives across calls. Only successful construction is cached;
errors are retried.
- Moves the HTTP client onto `Config.HTTPClient`, wired through
`ConvertConfig`, so `Git()` no longer takes a per-call argument that
would be silently ignored after memoization.
- `newGitHub` and `newGitLab` now return `(Provider, error)`,
eliminating the typed-nil-interface class in `gitprovider.New` rather
than the single instance.
- Gates the 304 branch on a `haveCached` flag instead of a nil body
check.
- Only caches bodies that decode successfully, preventing poisoned
entries.
- Keys the response cache on the full token digest rather than a
truncated prefix.
- Tests added: `TestConfigGitMemoizesProvider`,
`TestConfigGitRetriesOnConstructorError`,
`TestGitLabConstructorErrorReturnsNilInterface`,
`TestResponseCacheStore`,
`TestConditionalRequestReuse/MalformedResponseNotCached`;
`TestConvertYAML/CustomScopesAndEndpoint` now asserts
`Config.HTTPClient` wiring.

Follow-ups tracked in #28139, #28140, #28141, #28142.

> 🤖 Generated by Coder Agents on behalf of @johnstcn.

coderd/externalauth/gitprovider/gitlab_test.go

@@ -262,6 +262,18 @@ func TestGitLabResolveBranchPullRequest(t *testing.T) {
 	})
 }
 
+func TestGitLabConstructorErrorReturnsNilInterface(t *testing.T) {
+	t.Parallel()
+
+	// A construction error must return a true nil Provider, not a
+	// non-nil interface boxing a nil *gitlabProvider. The gp == nil
+	// check is what callers write, and require.Nil alone would pass
+	// for a non-nil interface holding a nil pointer.
+	gp, err := gitprovider.New("gitlab", "://invalid/", nil)
+	require.Error(t, err)
+	require.True(t, gp == nil, "provider must be nil when construction fails, got %T", gp)
+}
+
 func TestGitLabRateLimit(t *testing.T) {
 	t.Parallel()