feature: add support for webhooks

[greenpau]

Per @joeworkman,

webhook secret key is pretty simple. It's purely making sure that a specific header has a specific value.
For Github the header is X-Hub-Signature-256. We simply need to compare that with the stored key.
FYI. Gitlab's header for web hooks is X-Gitlab-Token

Add Caddyfile directive:

git {
  repo foo {
    webhook name <header> <secret>
  } 
}

When a request comes via API endpoint, inspect the header and authorize based on the presence of the webhook header and secret.

[QuLogic]

It doesn't appear that you actually validate X-Hub-Signature-256?

[greenpau]

@QuLogic , want to put a fix? :-)

[greenpau]

It doesn't appear that you actually validate X-Hub-Signature-256

Reopening it.

[greenpau]

Will address the signature validation via #11