Document that webhook secret token is sent in X-Gitlab-Token HTTP header

What does this MR do?

Note that the secret token is sent in the X-Gitlab-Token header on the webhook documentation page, as well as directly below the secret token field on the webhook settings form.

Are there points in the code the reviewer needs to double check?

No.

Why was this MR needed?

It took me a while to figure out how to verify the token in my hook endpoint. Issue #18256 (closed) is where I found how to do it.

What are the relevant issue numbers?

#18256 (closed)

Screenshots (if relevant)

Does this MR meet the acceptance criteria?

• CHANGELOG entry added
• Documentation created/updated
• API support added
• Tests
  • Added for this feature/bug
  • All builds are passing
• Conform by the style guides
• Branch has no merge conflicts with master (if you do - rebase it please)
• Squashed related commits together Closes #18256 (closed)