Rotate a webhook signing secret

Mints a new whsec_ secret and returns it once, the same as create. The previous secret stays valid for 24 hours. The response includes previous_secret_expires_at and previous_secret_active true, and does not return the previous secret. Rotating again replaces the previous secret and resets the window. A hook with no secret just stores the new one. Same permission as PATCH (webhook_write). During the window x-cooper-signature is sha256=<hex>,sha256=<hex> and x-cooper-signature-v2 is v1=<hex>,v1=<hex>, current secret first. Accept the delivery when any comma-separated segment matches. Another account's id is 404 webhook_not_found.