Process for Validating a Webhook

[kristinapathak]

https://github.com/xmidt-org/webpa-common/blob/a81c75dd06641b1a9928dcb93f60faeba4eebc3d/webhook/webhook.go#L65

Add a way to validate a webhook, with configurable rules to apply against it. This would allow us to:

• only allow https endpoints
• have an endpoint url denylist (so no one can register for localhost)
• not allow https endpoints with ip addresses

There is currently a sanitize() function and it may be that parts of that can be incorporated into this.
https://github.com/xmidt-org/webpa-common/blob/a81c75dd06641b1a9928dcb93f60faeba4eebc3d/webhook/webhook.go#L86

Then when someone tries to register for a new webhook that's invalid, we can return a 400.

[kristinapathak]

Validation could also be configured to ensure the url is a valid URI, removing the need to do it later:
https://github.com/xmidt-org/caduceus/blob/master/outboundSender.go#L163

[kristinapathak]

This would also allow us to check the Until time:
#12