Replace webhook custom delivery headers

Replaces the webhook's custom headers wholesale; send {"headers": {}} to clear them. These headers are sent on every delivery attempt and every retry, so an endpoint that requires its own Authorization header can be used without polling. Values are write-only — responses mask them.