Add guidance on the GH personal access token storage and possibly improve the admin UI to help

[yorkshire-pudding]

Following the experiences of a fellow Backdrop user who had a token for a cloud storage service in config and in a public repo, I realised that if someone is using a public repo to store their site including the config folders, then storing the GH personal access token in config is not sensible and should be stored in settings.php

At minimum add guidance on screen and in README and wiki

Also consider making the field for the GH token in the config screen conditionally visiting and enabled only once the user has accepted the risk.

[yorkshire-pudding]

Added a line to README about security - see commit