Register a webhook endpoint for the workspace.

Events are delivered for the workspace’s assets. Each request carries X-Sluby-Event, X-Sluby-Delivery (the same on every retry of one delivery), X-Sluby-Timestamp (Unix seconds, per attempt) and X-Sluby-Signature-V1, the hex HMAC-SHA256 of `<timestamp>.<raw body>` with the endpoint secret; receivers should refuse a timestamp more than five minutes from their clock. X-Sluby-Signature (the HMAC of the body alone) is still sent but deprecated, since it does not bind a time. The body is `{ id, event, timestamp, data }`, where `id` identifies the event across retries. The URL must be http(s) and its host must resolve only to public addresses (or to the operator's WEBHOOK_ALLOWED_NETWORKS); this is checked again before every delivery, redirects are not followed and response bodies are not read or stored. The secret is returned once.

curl -X POST 'https://sluby.example.com/api/v1/webhooks' \  -H 'Content-Type: application/json' \  -d '{  "url": "http://example.com",  "events": [    "upload.started"  ]}'

{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "url": "string",  "events": [    "string"  ],  "secret": "string"}