First, let's clarify what you are asking. A "404 Not Found" page corresponds to a 404 response header from the server. Technically, there are other headers a server could send if you are not authorized to view the current uri, such as "403 Forbidden" or "401 Unauthorized" etc.
However, I believe what you are actually asking is not necessarily what header to respond with but what to actually display to the user when a user does not have access to a uri. The answer to that is really up to the web service to handle, as the "correct" answer could really be one way or the other per situation.
In your example using Github, you've identified that private repositories should not be able to be identified if you do not have access. In a case where Github decided to display a "unauthorized" message when we do hit a private repo's uri then we could attempt to use that information maliciously. For instance, if we got the following:
https://github.com/microsoft/outlook -- Returns 404 Not Found
https://github.com/apple/ios8 -- Returns 404 Not Found
https://github.com/google/gmail -- Returns 403 Forbidden
Then we know for sure that the user "google" keeps a repo called "gmail" on github. That knowledge alone could be used to further maliciously attempt to gain access. But, if all those addresses returned the same 404 regardless of whether or not they exist, then we would have no idea one way or the other.
On the flip side, let's say a service's shares photos publicly, and every public photo has a predictable
/edit added to the URI.
:: Authenticated as "rgthree"
http://myphotos.com/user/rgthree/photos/000000001/ - 200 Success
http://myphotos.com/user/rgthree/photos/000000001/edit - 200 Success
http://myphotos.com/user/avi/photos/000000001 - 200 Success
http://myphotos.com/user/avi/photos/000000001/edit - 403 Forbidden
In this case it's fine to let me know I do not have editable access; there's no need to hide the fact that the endpoint is protected.