Stop future sends to one project webhook.

Private, no-store and no CORS grant. Requires the configured optional webhook service. Only the human account owner can manage destinations. Installation tokens and API keys are refused. Requires recent authentication, CSRF and exact empty JSON. Revocation prevents a reserved delivery from starting. A request already in flight can still arrive. Repeated revocation performs no write. Inventory, email, event readers and purchased rights remain available. Returns: { revogado }