feat(github): respect new prAllowMaintainerEdits option

This commit ensures the GitHub platform logic respects the
new `prallowMaintainerEdits` option.

Whenever a PR is created, depending on the option value,
the GitHub API post request will have the respective
option `maintainer_can_modify` option set.

This option was always enabled in fork mode before this commit,
and without fork mode enabled, the option is a noop because maintainers
have access to upstream branches regardless.

Users may want to leverage the option and disable it to avoid
issues with modifications in Renovate fork accounts, as described
in: renovatebot#19771

Fixes renovatebot#19771.

lib/modules/platform/github/index.spec.ts

@@ -2173,6 +2173,55 @@ describe('modules/platform/github/index', () => {
       expect(pr).toMatchObject({ number: 123 });
     });
 
+    it('should allow maintainer edits if enabled via options', async () => {
+      const scope = httpMock.scope(githubApiHost);
+      initRepoMock(scope, 'some/repo');
+      scope
+        .post(
+          '/repos/some/repo/pulls',
+          // Ensure the `maintainer_can_modify` option is set in the REST API request.
+          (body) => body.maintainer_can_modify === true
+        )
+        .reply(200, {
+          number: 123,
+          head: { repo: { full_name: 'some/repo' }, ref: 'some-branch' },
+        });
+      await github.initRepo({ repository: 'some/repo' });
+      const pr = await github.createPr({
+        sourceBranch: 'some-branch',
+        targetBranch: 'main',
+        prTitle: 'PR title',
+        prBody: 'PR can be edited by maintainers.',
+        labels: null,
+        allowMaintainerEdits: true,
+      });
+      expect(pr).toMatchObject({ number: 123 });
+    });
+
+    it('should not allow maintainer edits if not explicitly set', async () => {
+      const scope = httpMock.scope(githubApiHost);
+      initRepoMock(scope, 'some/repo');
+      scope
+        .post(
+          '/repos/some/repo/pulls',
+          // Ensure the `maintainer_can_modify` option is unset in the REST API request.
+          (body) => body.maintainer_can_modify === undefined
+        )
+        .reply(200, {
+          number: 123,
+          head: { repo: { full_name: 'some/repo' }, ref: 'some-branch' },
+        });
+      await github.initRepo({ repository: 'some/repo' });
+      const pr = await github.createPr({
+        sourceBranch: 'some-branch',
+        targetBranch: 'main',
+        prTitle: 'PR title',
+        prBody: 'PR *cannot* be edited by maintainers.',
+        labels: null,
+      });
+      expect(pr).toMatchObject({ number: 123 });
+    });
+
     describe('automerge', () => {
       const createdPrResp = {
         number: 123,

lib/modules/platform/github/index.ts

@@ -1474,6 +1474,7 @@ export async function createPr({
   prBody: rawBody,
   labels,
   draftPR = false,
+  allowMaintainerEdits,
   platformOptions,
 }: CreatePRConfig): Promise<GhPr | null> {
   const body = sanitize(rawBody);
@@ -1489,12 +1490,12 @@ export async function createPr({
       base,
       body,
       draft: draftPR,
+      maintainer_can_modify: allowMaintainerEdits,
     },
   };
   // istanbul ignore if
   if (config.forkToken) {
     options.token = config.forkToken;
-    options.body.maintainer_can_modify = true;
   }
   logger.debug({ title, head, base, draft: draftPR }, 'Creating PR');
   const ghPr = (