fix: Correct retry logic - #3703

Because newRateLimitTransport sits outside retryTransport, secondary rate-limit retries (403/429 with Retry-After) loop inside go-github-ratelimit without going back through retryTransport's if i 0 rewind. Over HTTP/2 (ForceAttemptHTTP2 = true), the second attempt sends an empty req.Body (request declared a Content-Length of ... but only wrote 0 bytes).

Here is a quick test sketch that reproduces it:

srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	body, _ := io.ReadAll(r.Body) // attempt 1: `{"query":"mutation"}`, attempt 2: ""
	if attempt.Add(1) == 1 {
		w.Header().Set("Retry-After", "1")
		w.WriteHeader(http.StatusForbidden)
		w.Write([]byte(`{"message": "You have exceeded a secondary rate limit"}`))
		return
	}
	if len(body) == 0 {
		w.WriteHeader(http.StatusBadRequest)
		return
	}
	w.WriteHeader(http.StatusOK)
}))
srv.EnableHTTP2 = true
srv.StartTLS()

tr := newRateLimitTransport(srv.Client().Transport)
tr, _ = newRewindableTransport(tr, 0)

req, _ := http.NewRequest(http.MethodPost, srv.URL, bytes.NewBufferString(`{"query":"mutation"}`))
resp, _ := tr.RoundTrip(req) // resp.StatusCode == 400 because attempt 2 had an empty body

Can you rewind req.Body before every attempt that enters newRateLimitTransport's inner transport when req.GetBody != nil?

Moving logging.NewLoggingHTTPTransport to the outermost layer means httputil.DumpRequestOut(req, true) runs before rewindableTransport makes its shallow copy (reqCopy := *req) or throttleTransport acquires a concurrency slot. When TF_LOG is enabled, DumpRequestOut drains and replaces the caller's req.Body in place, and it also hides individual retry/rate-limit attempts from debug logs.

Here is a quick test sketch showing the caller mutation:

t.Setenv("TF_LOG", "DEBUG")

tr, _ := newRewindableTransport(srv.Client().Transport, 0)
tr = logging.NewLoggingHTTPTransport(tr)

origBody := io.NopCloser(strings.NewReader("hello"))
req, _ := http.NewRequest(http.MethodPost, srv.URL, origBody)
_, _ = tr.RoundTrip(req)
// req.Body != origBody (mutated in place by httputil.DumpRequestOut before rewindableTransport's reqCopy)

Can you keep logging.NewLoggingHTTPTransport inside retryTransport (around the base/cache/OAuth transport, as before) so rewindableTransport protects the caller's req first and debug logs still show each wire attempt?