A webhook sender is not a browser. It holds no cookie to double-submit and
cannot be made to send one, so an application with CSRF enabled rejects
every delivery with 403 before the payload's own signature is ever checked.

Silent from both ends: nothing is logged our side because the request never
reaches a handler, and the provider sees only a 403 it eventually stops
retrying. In a production deployment this took down every Paddle webhook —
cancellations, payment failures and plan changes all stopped arriving — and
was found only because a plan change failed to reach the database.

SkipCsrf's own docblock names webhook receivers as the case it exists for.
Neither of the two receivers the framework ships used it.

Skipping costs nothing: these controllers already authenticate by HMAC
signature, source IP and replay window, each strictly stronger than an
ambient cookie.

The test enumerates the receivers rather than trusting review to catch the
next one added, and fails against both controllers as they were.

Split from bd200906e4b86784d9a0ac5d5810e4d152363c4e