Registers a URL to receive one event type for the authenticated account. The
secret is used to sign outbound deliveries and is never returned by any
endpoint - store it when you register.

One URL may be registered once per event, and an account has a fixed maximum
number of webhooks; both are reported as 400. DELETE /api/webhooks/{id}
frees a registration.

The URL must be https. Deliveries go only to public addresses: a URL whose host
resolves to a private, loopback or link-local address registers, and every
delivery to it fails.