Move webhooks into own schema/model, add webhook secret.

We want to be able to sign our webhook requests so the other end can
verify the request is coming from a trusted source. Our plan is to
generate a unique shared secret for each registered webhook. This secret
will be used *only* for signing outgoing webhook requests.