Add webhook_key parameter to workflow_job_template

[blaipr]

Summary

• The controller API's /api/v2/workflow_job_templates/ endpoint has a writable webhook_key field ("Shared secret that the webhook service will use to sign requests. Leave blank to generate a new one when the webhook service is set.") that the workflow_job_template module did not expose yet.
• I added a webhook_key option (type: str, no_log=True), following the same optional-field pattern already used for webhook_service.

Verification

I verified this against a live Ascender dev server (OPTIONS/GET/POST/PATCH against /api/v2/workflow_job_templates/) before and after the change:

• OPTIONS on the endpoint confirms webhook_key is type: string, write_only: True, matching the description in this PR.
• webhook_key is never echoed back by the API in POST, PATCH, or GET responses, confirmed by creating a workflow job template with webhook_key set and inspecting the raw JSON body each time: the key is absent in all three.
• Using the updated module, I created a uniquely-named workflow job template (zz-test-wfjt-webhook-key) with webhook_service: github and an explicit webhook_key, which succeeded (changed=true).
• Because the field is write-only and never returned by the API, the module cannot compare the stored value to the desired one on a second run. ControllerAPIModule defaults update_secrets to True for exactly this class of field, so re-running the module with identical parameters (including webhook_key) still reports changed=true and re-sends the PATCH, with a warning that the field has encrypted/write-only data and may inaccurately report the task as changed. This is the same behavior already accepted for other write-only secret fields in this collection, not a regression introduced here.
• I deleted the test workflow job template afterward (state=absent, changed=true) and confirmed via a direct GET that it no longer exists (404).

I intentionally left tests/unit/test_completeness.py untouched. Once this PR and #165 both merge, the workflow_job_template entry in needs_param_development (currently ['webhook_key']) can be dropped since the module will be feature-complete for that field.