UX: non-obvious that API tokens need to be stored as UsernamePassword to work as scan credentials

The drop down dialog to select github org scan credentials only lists `UsernamePasswordCredentialsImpl` credentials. While the `github` plugin also supports `StringCredentialsImpl` credentials – I found this rather confusing as I only use github API tokens. I have a preference for using API tokens with robots as it is somewhat easier to revoke access.