Signing secrets at rest. They cannot be hashed — signing needs the
plaintext — so they are AES-256-GCM encrypted, in the `enc:v1:` format the
user module uses for MFA seeds.

`IWebhookTransport` over Apache HttpClient: bounded connect and request
timeouts, redirects and retries off, and at most `max-response-bytes` of the
answer read.

Apache rather than java.net.http because it takes a DNS resolver: a request
carrying `:addresses` connects to those, while the Host header, TLS SNI and
certificate hostname check still use the URL's host.

Integrant wiring for outbound webhooks.

:wagoe/webhooks                 the `IWebhooks` service
:wagoe.webhooks/db-schema       creates the tables when `migrate up` has not
:wagoe.webhooks/job-handlers    `{:webhooks/deliver handler}` for the job registry
:wagoe.webhooks/subscriber      listens on the bus `:topics` and dispatches

Needs the jobs module; `:topics` needs the events module. Events published
through the outbox reach the bus only after their transaction commits, so a
rolled-back change sends no webhook.

`ISubscriptionStore` and `IDeliveryLog` on the application database, and the
boot step that creates their tables.

`IWebhooks`: subscriptions in, one job per delivery out, one log row per
attempt.

Refusing webhook targets inside the network the application runs in.

A webhook URL is chosen by whoever creates the subscription, and the request
is made from the server: without this, a tenant could point one at the cloud
metadata endpoint or an internal admin port and read the answer in the
delivery log.

Checked at create time and again before every attempt, because DNS can
change in between. The attempt connects to the addresses that check
approved, so a name that answers differently a second time (DNS rebinding)
gets no second lookup. `:allowed-hosts` is the way to reach a private host
on purpose.