fix(repos): omit the default private and internal forking setting

[NWarila]

Why

On 2026-09-29 the control plane flipped aws-monitoring-terraform-framework from public to private and the apply
ended with 422 This organization does not allow private repository forking on the repository PATCH (run
36578849679). The declared end state converged anyway, and later detector runs show no drift, so the failure was
transition-only — but every public→private flip in this organization would hit it.

The provider (integrations/github 6.12.1) sends allow_forking in the same PATCH as a visibility change, and only
when the attribute changed. This module's default moved true (public) → false (organization-owned private) with
the flip, so the request carried allow_forking=false alongside visibility=private, and the organization, which
forbids private forking, rejects the field's presence in that request. Executed against the provider's own update
path: with the attribute configured false the second PATCH carries it; with the attribute omitted, neither PATCH
does.

What changes

When YAML omits allow_forking, a private or internal repository now defaults to null: the field is not sent, so
on an organization-owned repository the organization's own setting governs. That is the treatment personal-account
private repositories already had, and the same stance #105 took for organization-enforced security settings. Public
still defaults to true; explicit YAML values still pass through, and explicit false on a public repository is
still rejected.

Explicit values are a separate matter, now documented rather than changed: on an organization-owned private or
internal repository an explicit allow_forking requires the organization to allow private forking first, and a
managed org_settings defaults that to false, as this organization has it. The checked-in private declarations
omit the key; plan-time handling of explicit values is a follow-up piece.

allow_forking is optional and computed with no default in the provider, so an existing repository keeps its stored
value and plans nothing: the three private repositories in the organization all hold false in state and are
unaffected whether their declaration omits the key or sets false (a mocked stateful test with the exact provider
plans No changes).

Also corrects documentation that contradicted the code: README.md said the key was rejected and unmanaged while
the module allows, defaults and sends it; DESIGN.md and docs/reference/security-posture.md described a
single or ownership-dependent default. Tests F2 and F3 now assert the new defaults.

Effect on the consumer

None until github-terraform-runner bumps its framework pin. That pin-bump PR's plan must show zero actionable
rows; any row is a finding.