Rotate the calling application's webhook signing secret

Generates a new webhook signing secret for the authenticated application, stores only its hash, and returns the raw secret once.

Use the returned webhookSecret to verify X-IDaaS-Signature on inbound webhooks. The previous webhook secret becomes invalid immediately.