Rotate callback signing secret

Generates a new signing secret for the workspace's SMS callback URLs and returns it exactly once: store it immediately, it cannot be retrieved after this response. The secret is shared by every callback URL in the workspace. For 24 hours deliveries are signed with both the old and the new secret, then the old one stops signing.

A workspace holds at most 5 concurrently valid secrets, so rotating repeatedly within the overlap window fails with WebhookTooManySecrets until an older secret expires.