Expose workspace webhooks through the API and MCP

[paulocastellano]

Summary

• Extract webhook create/update/delete/test/rotate/replay into Actions and share validation via WebhookRules, so the web UI, REST API, and MCP stay in lockstep.
• Add the public API (/webhooks) and nine MCP tools covering everything the web UI can do: list, show (with secret), create, update, send-test, rotate-secret, logs, replay, and delete.
• Keep manageWebhooks (owner + workspace admin only). Signing secrets stay off the list; they appear only on create, show, and rotate.

Test plan

• Create/update/send-test/rotate/replay/delete a webhook in the web UI and confirm behavior is unchanged
• Hit GET/POST/PUT/DELETE /webhooks plus send-test, rotate-secret, logs, and replay with an owner/admin API token
• Confirm a member/viewer token gets 403 on every webhook API endpoint
• Confirm list omits signing_secret and create/show/rotate return it
• Run the same flows via MCP tools and confirm member/viewer tools are denied
• Confirm an SSRF-blocked endpoint fails create/update the same way on web, API, and MCP