Release v0.3.0

Added

• Capture webhook sources accept inbound authorization: captures.Webhook(path, captures.WithBasicAuth(...)), WithBearerToken or WithOAuth, readable through Source.Authorization() and Definition.Authorization(). Authorization never appears in the capture declaration text, and is redacted from fmt and log/slog output, including when held in private fields (part of #37)

Changed

• captures.Service.Validate and Save return ErrUnsupported for a definition that carries source authorization, before anything is sent to the kernel, so credentials are never silently dropped. The kernel's capture contract cannot carry authorization yet (Cratis/Chronicle#4591) (part of #37)
• A webhook source rejects blank credentials and more than one authorization option at Build; C# keeps only the last option (part of #37)
• json.Marshal and json.Unmarshal of capture Source, Definition, Builder and SourceAuthorization now fail with ErrUnsupported instead of producing {}, so credentials cannot be serialized or silently decoded as no authorization (part of #37)