Add a generic webhook event listener for audit/SIEM integration

Polaris has an event-listener framework with several built-in listeners, but the current push-style options don't cover a common operational need: shipping audit events to a generic HTTP endpoint.

The available options today are:
```
OpenTelemetry - requires deploying and operating an OTLP collector
AWS CloudWatch - AWS-only
In-memory buffer - stores events inside Polaris but does not push them
Kafka (in progress) - requires a Kafka cluster
```

Many SIEM and audit systems - Splunk HEC, Elasticsearch/Logstash[HTTP], Opensearch, Datadog, custom collectors - accept plain `HTTP + JSON` webhooks. A generic webhook listener would let operators stream Polaris events (catalog, principal, credential, task, rate-limiting, etc.) into these systems without extra infrastructure.

Add a new event listener type webhook `(polaris.event-listener.types=webhook)` that:

- POSTs each sanitized Polaris event as JSON to a configurable HTTP endpoint `(polaris.event-listener.webhook.endpoint)`
- Optionally signs the payload with **HMAC-SHA256** using a shared secret `(polaris.event-listener.webhook.secret)`, sending the signature in the header`X-Polaris-Signature-256: sha256=` so receivers can verify authenticity and integrity
- Retries failed deliveries (non-2xx responses or connection errors) with exponential backoff, then drops the event and logs an error
- Only receives sanitized events _(no raw/credential data)_

Configuration

```
polaris.event-listener.types=webhook
polaris.event-listener.webhook.endpoint=https://siem.example.com/events
polaris.event-listener.webhook.secret=optional-hmac-secret
polaris.event-listener.webhook.max-attempts=5
polaris.event-listener.webhook.retry-backoff=1s
```

**Kafka and OpenTelemetry** are powerful, but both require additional infrastructure. A plain HTTP webhook is the lowest-friction option for teams that already have an `HTTP` ingestion endpoint in their SIEM / audit pipeline and just want Polaris events flowing into it with minimal operational overhead..

Locate the event-listener framework and existing built-in listeners, then trace how sanitized events are produced and how listener configuration is tested. Review the HTTP client and retry patterns already used in the repository before deciding how webhook delivery and HMAC signing fit. Done means a configurable webhook receives sanitized JSON, optionally sends the specified signature, retries failures, and has tests for success, signing, and retry behavior.

Written by the indexing model from the issue text.