List webhook subscriptions

Lists active webhook subscriptions for the account, optionally filtered by project. A read-only API key receives each target_url masked to its scheme, host and any non-default port followed by /…, because the full URL can let anyone post to the receiver; a read_write scope key receives the full URL. Works on every plan, with an API key created on Scale too. Below Scale the subscriptions are kept but deliver nothing, and they can still be listed and deleted.