feat: add support for github webhook secret

[lucadv]

This adds a secret to the config of the webhook. Without it we are unable to verify webhook signatures in POST requests. See https://docs.github.com/en/developers/webhooks-and-events/webhooks/securing-your-webhooks#validating-payloads-from-github