fix: classify git failures on stderr, restrict migration failure detail (#39010)

Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

services/migrations/error.go

@@ -6,6 +6,9 @@ package migrations
 
 import (
 	"errors"
+	"net/http"
+
+	"gitea.dev/modules/git/gitcmd"
 
 	"github.com/google/go-github/v91/github"
 )
@@ -24,3 +27,12 @@ func IsTwoFactorAuthError(err error) bool {
 	_, ok := err.(*github.TwoFactorAuthError)
 	return ok
 }
+
+// IsAuthenticationError returns true if the remote rejected the credentials, over git or over its HTTP API
+func IsAuthenticationError(err error) bool {
+	if gitcmd.IsStderr(err, gitcmd.StderrAuthenticationFailed, gitcmd.StderrCouldNotReadUsername) {
+		return true
+	}
+	githubErr, ok := errors.AsType[*github.ErrorResponse](err)
+	return ok && githubErr.Response != nil && githubErr.Response.StatusCode == http.StatusUnauthorized
+}