[AVM Module Issue]: container-registry/registry webhook customHeaders should be @secure() (triggers use-secure-value-for-secure-inputs)

### Module Name

`avm/res/container-registry/registry`

### Module Version

`0.12.1`

### Issue Type

Security Bug

### Description

The `webhook` child module of `avm/res/container-registry/registry` declares `param customHeaders object?` without the `@secure()` decorator, while `serviceUri` is correctly marked `@secure()`. Webhook custom headers commonly carry authentication material (e.g. an `Authorization` header), so this parameter can flow a sensitive value without secure handling. Building the module raises the linter warning `use-secure-value-for-secure-inputs` on the webhook submodule, which also blocks consumers enforcing a 0-warning gate.

**Expected:** `customHeaders` marked `@secure()` (or a documented rationale), so the module builds without the warning.

**Actual (0.12.1 and current `main`):** `param customHeaders object?` is not secure → `use-secure-value-for-secure-inputs`.

**Repro:**
```bash
git clone --filter=blob:none https://github.com/Azure/bicep-registry-modules.git tmp
git -C tmp checkout -f avm/res/container-registry/registry/0.12.1
az bicep build --file tmp/avm/res/container-registry/registry/main.bicep
# → Warning use-secure-value-for-secure-inputs in webhook/main.bicep
```

Isolation note: reproduced with and without any custom linter config — the warning is intrinsic to the submodule source and not suppressible from a consumer's `bicepconfig.json`.

Run the provided az bicep build command, then inspect the webhook submodule's webhook/main.bicep under avm/res/container-registry/registry. Confirm the customHeaders parameter and serviceUri declaration, make the requested secure-handling change or document a rationale, and rerun the build to verify the use-secure-value-for-secure-inputs warning is gone.

Written by the indexing model from the issue text.