Do not validate CLAs when PRs are closed
Add note to annotation re: future guards
Use currybowl for Curry hub callbacks.

Use a currybowl URL in development and test instead of RequestB.in.
currybowl does not remove the created bowl after 48 hours like
RequestB.in does. This allows for the same end point to be used for
testing and development to verify that GitHub is posting updates to a
callback.

In production, Supermarket uses the Curry::PullRequestUpdates create
action as the end point.

This commit also takes care to filter sensitive data from cassettes.