Create a signed webhook endpoint and return its id, URL, events, and one-time secret.

Costs nothing quota-wise. Call after choosing a non-empty subset of the six events, and store the returned secret immediately. Recover from validation_error by fixing the HTTPS URL or event names, webhook_limit_reached by deleting an unused endpoint, and rate_limited by waiting retry_after_sec before retrying.