Don't use Header.Add where Header.Set is sufficient.
This is largely a style change. In the case of NewRequest and NewUploadRequest, it is completely a noop given current code (since a new request is created, and each header is added only one time). For BasicAuthTransport, it's a noop as long as incoming request doesn't already have "X-GitHub-OTP" header set (and if it did, then this is a better behavior to change its value rather than add a new one).
Even though these changes are largely noops, Header.Set is a simpler primitive to reason about, and it's more representative of the intended action. For "Content-Type", "Accept", and "User-Agent" headers, multiple such headers do not make sense, so it's better to use Header.Set than Header.Add.