What a receiver needs to check a Wagoe webhook, with no other part of the
library loaded.

  (webhooks/verify-signature secret raw-body
                             (get-in request [:headers "wagoe-signature"]))

Verify against the raw body, before parsing it: re-serialised JSON is not
the bytes that were signed. Use the `Wagoe-Event-Id` header to drop
deliveries already handled — a retry after a lost response sends the same
event again.

Which subscriptions an event goes to, what is sent, and what an attempt's
outcome means. Pure: the clock, ids and I/O come from the shell.

The `Wagoe-Signature` header: `t=<unix seconds>,v1=<hex HMAC-SHA256>` over
`<t>.<body>`. Signing the timestamp with the body is what stops a captured
request being replayed later: the receiver refuses an old `t`, and cannot be
handed a new `t` with the old signature.

Outbound webhooks: where subscriptions live, where attempts are recorded,
how a request leaves the process, and what the rest of an application calls.

Malli schemas for subscriptions and the module's settings.

Signing secrets at rest. They cannot be hashed — signing needs the
plaintext — so they are AES-256-GCM encrypted, in the `enc:v1:` format the
user module uses for MFA seeds.

`IWebhookTransport` over Apache HttpClient: bounded connect and request
timeouts, redirects and retries off, and at most `max-response-bytes` of the
answer read.

Apache rather than java.net.http because it takes a DNS resolver: a request
carrying `:addresses` connects to those, while the Host header, TLS SNI and
certificate hostname check still use the URL's host.

Integrant wiring for outbound webhooks.

:wagoe/webhooks                 the `IWebhooks` service
:wagoe.webhooks/db-schema       creates the tables when `migrate up` has not
:wagoe.webhooks/job-handlers    `{:webhooks/deliver handler}` for the job registry
:wagoe.webhooks/subscriber      listens on the bus `:topics` and dispatches

Needs the jobs module; `:topics` needs the events module. Events published
through the outbox reach the bus only after their transaction commits, so a
rolled-back change sends no webhook.

`ISubscriptionStore` and `IDeliveryLog` on the application database, and the
boot step that creates their tables.

`IWebhooks`: subscriptions in, one job per delivery out, one log row per
attempt.

Refusing webhook targets inside the network the application runs in.

A webhook URL is chosen by whoever creates the subscription, and the request
is made from the server: without this, a tenant could point one at the cloud
metadata endpoint or an internal admin port and read the answer in the
delivery log.

Checked at create time and again before every attempt, because DNS can
change in between. The attempt connects to the addresses that check
approved, so a name that answers differently a second time (DNS rebinding)
gets no second lookup. `:allowed-hosts` is the way to reach a private host
on purpose.