[release/9.0] Fix OneLoc GitHub App installation selection

[missymessa]

Backport of #17312 to release/9.0.

OneLoc GitHub App authentication is enabled by default on this branch. This fix flattens the installations response, requires exactly one owner match, and prevents dotnet builds from receiving the Microsoft installation token.

Validation:

• PowerShell syntax parsing passes
• mocked response with Microsoft first selects dotnet correctly
• mocked response still selects Microsoft correctly
• git diff --check passes

Tracking: https://dev.azure.com/dnceng/internal/_workitems/edit/11966

[Copilot]

Pull request overview

This PR backports a fix to eng/common/Get-GitHubAppToken.ps1 on release/9.0 to correctly select the intended GitHub App installation when multiple installations exist, avoiding minting a token for the wrong owner (notably preventing dotnet builds from accidentally using the microsoft installation).

Changes:

• Avoid nested-array behavior from Invoke-RestMethod by assigning the response before wrapping it, ensuring installations are enumerated correctly across pages.
• Require exactly one installation matching InstallationOwner (fail fast on 0 or >1 matches instead of silently taking the first).
• Log the selected installation owner and installation ID for diagnosability.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.