Send a project's events to one more URL, beside its own webhook.

For apps that turn a project's events into their own triggers: a zap or a workflow subscribes when it is switched on and deletes its subscription when it is switched off. Each subscription has a secret of its own (subscription.secret, here only): its messages are signed with it, as X-MeshArc-Signature, exactly as the project's own are with the project's. Subscribing the same URL to the same project again returns that subscription (200, created: false) with the events now named. 400 on a URL that is not public http(s) or an event the project does not send; 409 when the project has 25 already.