Provision project webhook policies from values

Problem

Downstream systems that index or mirror what lands in Harbor need change notification. Harbor has webhook policies for this (PUSH_ARTIFACT, DELETE_ARTIFACT, TAG_RETENTION, SCANNING_*, etc., with Default or CloudEvents payloads), but they are per-project DB state configured in the UI today. They do not survive a fresh install, and the consumer's endpoint URL and shared auth header end up in nobody's version control.

Proposal

Add bootstrap.webhooks[] applied from the post-install job introduced in #2:

bootstrap:
  webhooks:
    - project: cogs
      name: collab-hub-cog-index
      endpoint: https://collab-hub.example.com/cogs/registry-events
      events: [PUSH_ARTIFACT, DELETE_ARTIFACT]
      payloadFormat: Default          # Default | CloudEvents
      authHeader:                     # sent verbatim as the Authorization header
        secretName: harbor-webhook-cog-index
        secretKey: authorization
      skipCertVerify: false
      enabled: true

API surface: GET/POST /api/v2.0/projects/{name}/webhook/policies, PUT .../webhook/policies/{id}; GET /projects/{name}/webhook/events lists the supported event and notify types for validation.

Requirements

• Idempotent by (project, name): create if absent, otherwise PUT so endpoint/event changes in values propagate on helm upgrade.
• The auth header value comes from a Secret, never from values.
• Validate events against /webhook/events and fail the job with a clear message on a typo rather than silently creating a policy with no events.
• Depends on #2 (project must exist).

Non-goals

Anything about what the receiving endpoint does with the payload. This issue is only about the registry declaring where to send events.

Acceptance

• Fresh make up-sso with a webhook entry creates the policy; pushing an artifact to the project delivers a PUSH_ARTIFACT payload to the endpoint with the configured Authorization header.
• Changing endpoint or events in values and running helm upgrade updates the existing policy (no duplicates).
• README values reference + docs.

Context

Motivated by nebari-dev/collab-hub-pack#7 (near-real-time indexing of cog pushes). Related: #2 (projects), #3 (robot provisioning).

Start with the post-install job introduced in #2 and the Helm values used by make up-sso; inspect how project and robot provisioning are structured. Add webhook configuration, Secret-backed authorization, event validation, and idempotent updates through Harbor's webhook policy APIs. Verify fresh installation, helm upgrade changes without duplicates, artifact delivery, and the README values reference.