Add Google Analytics, Dotfile, Segment and Square access-review connectors

Two OAuth2 and two API-key connectors:

- Google Analytics (GA4): OAuth2 with both analytics.readonly and
  analytics.manage.users.readonly (readonly alone 403s on the accounts
  list); v1alpha accessBindings enumerated at account and property level
  and merged by email; manual account picker (Pattern 1) with a
  per-connection probe and name resolver; distinct from Google Workspace.
- Dotfile: API key in the X-DOTFILE-API-KEY header (Pattern 3); GET
  /v1/users (owner/admin, suspended_at) with a static probe.
- Segment (Twilio): Public API token as Bearer with a required Region
  setting (US or EU) mapped to the regional host; GET /users plus per-user
  GET /users/{id} for roles and /invites for pending members; per-connection
  BuildProbeURL.
- Square: OAuth2 (EMPLOYEES_READ) or a personal access token (Pattern 3);
  POST /v2/team-members/search returns email/status/is_owner directly, so no
  role resolution; custom probe and name resolver.

Google Analytics and Square are confidential OAuth clients, wired into the
bootstrap OAuth provider list and .env.example. Segment carries a required
extra setting, so the console add-source dialog maps region onto its
segmentRegion API-key input; without that mapping the value is silently
dropped and the create is rejected.

Cassette-backed driver tests plus unit tests for the Segment probe URL and
the bootstrap OAuth provider list.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/organizations.go

@@ -25,7 +25,9 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/url"
 	"strconv"
+	"strings"
 )
 
 // Organization represents a tenant/workspace/team/group surfaced by a
@@ -470,3 +472,77 @@ func ListClickUpOrganizations(ctx context.Context, httpClient *http.Client) ([]O
 
 	return result, nil
 }
+
+// ListGoogleAnalyticsOrganizations fetches the GA4 accounts the authenticated
+// Google user can access, surfacing each account's numeric ID as the picker
+// slug. Listing accounts requires the analytics.readonly scope.
+func ListGoogleAnalyticsOrganizations(ctx context.Context, httpClient *http.Client) ([]Organization, error) {
+	var orgs []Organization
+
+	pageToken := ""
+
+	for range maxPaginationPages {
+		q := url.Values{}
+		q.Set("pageSize", strconv.Itoa(googleAnalyticsPageSize))
+
+		if pageToken != "" {
+			q.Set("pageToken", pageToken)
+		}
+
+		endpoint := url.URL{
+			Scheme:   "https",
+			Host:     googleAnalyticsAPIHost,
+			Path:     "/v1alpha/accounts",
+			RawQuery: q.Encode(),
+		}
+
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint.String(), nil)
+		if err != nil {
+			return nil, fmt.Errorf("cannot create google analytics accounts request: %w", err)
+		}
+
+		req.Header.Set("Accept", "application/json")
+
+		resp, err := httpClient.Do(req)
+		if err != nil {
+			return nil, fmt.Errorf("cannot fetch google analytics accounts: %w", err)
+		}
+
+		var out struct {
+			Accounts []struct {
+				Name        string `json:"name"`
+				DisplayName string `json:"displayName"`
+			} `json:"accounts"`
+			NextPageToken string `json:"nextPageToken"`
+		}
+
+		decodeErr := json.NewDecoder(resp.Body).Decode(&out)
+		status := resp.StatusCode
+		_ = resp.Body.Close()
+
+		if status != http.StatusOK {
+			return nil, fmt.Errorf("cannot fetch google analytics accounts: unexpected status %d", status)
+		}
+
+		if decodeErr != nil {
+			return nil, fmt.Errorf("cannot decode google analytics accounts response: %w", decodeErr)
+		}
+
+		for _, a := range out.Accounts {
+			id := strings.TrimPrefix(a.Name, "accounts/")
+			if id == "" {
+				continue
+			}
+
+			orgs = append(orgs, Organization{Slug: id, DisplayName: a.DisplayName})
+		}
+
+		if out.NextPageToken == "" {
+			return orgs, nil
+		}
+
+		pageToken = out.NextPageToken
+	}
+
+	return nil, fmt.Errorf("cannot list all google analytics accounts: %w", ErrPaginationLimitReached)
+}