Always generate webhook secrets by default

### Is your feature request related to a problem? Please describe.

When creating a webhook, the "Secret" field is optional and blank by default:

In most cases, this will be fine. However, a more secure default would be to generate a random secret directly from the browser. There's really no reason to ever use unsigned webhooks - if users don't care about the signature, they can choose to not verify it.

### Describe the solution you'd like.

Generate random webhook secrets directly when configuring them. Add an option to regenerate a secret if it needs to be changed.

Potentially, do not allow blank webhook secrets entirely.

### Describe alternatives you've considered

🤷

### Additional context

_No response_