Create or repoint the scan webhook

Idempotent: one endpoint per workspace, so this creates or replaces. Changing the URL KEEPS the signing secret, so moving from a staging host to a production one does not require redeploying verification code, and saving clears a failure state — re-saving is how a customer switches a disabled endpoint back on.

The URL must be https://, must not carry credentials, and must not resolve to loopback, link-local, carrier-grade-NAT or RFC1918 space. We are making requests to a URL the customer chose, which is a server-side request forgery primitive by construction; refusals come back as 400 with a message written for the customer, and the same check runs again before every delivery because DNS can be repointed after saving.