Rotate webhook signing secret

Generates a new signing secret for the endpoint and returns it exactly once: store it immediately, it cannot be retrieved after this response. For 24 hours every delivery is signed with both the old and the new secret, so a receiver verifying with either keeps working while you roll the new one out; after the window the old secret stops signing. Verification details are in the webhooks guide.

An endpoint holds at most 5 concurrently valid secrets, so rotating repeatedly within the overlap window fails with WebhookTooManySecrets until an older secret expires.