Revoke the public webhook URL and issue a new one

This is the revocation path for the webhook token. The token is a bearer capability: POST /api/webhooks/{token} is UNAUTHENTICATED, so anyone who has the URL can start production runs of this workflow. Once it leaks, rotating is the only way to take it back.

The old address stops working the instant this returns — anything still sending to it starts receiving 404. Re-point every producer at the new URL before rotating, or accept the gap.

What a caller must know:

• Only a workflow whose triggerType is webhook has a URL to rotate; anything else is a 409 CONFLICT, not a silent no-op.
• The new token is returned ONCE here as webhookToken. It is also readable afterwards from GET /api/workflows/{id} — but only by a credential holding workflow:run; below that the field is redacted, and the workflow LIST never carries it at all.
• The full public URL is the API's public base + /api/webhooks/ + the token.
• Rotating does NOT re-register the new URL with a self-registering trigger piece; re-publish to do that.
• No request body is read.