Add duo_flow_callback_enabled to web_hooks

What does this MR do and why?

Adds a duo_flow_callback_enabled boolean to web_hooks (default false, NOT NULL).

It is a capability flag, not an event subscription: deliberately not named *_events and not registered in TriggerableHooks, so it never fires from ordinary webhook event dispatch. A Maintainer or Owner sets it on a normal project or group webhook to opt that hook in as a Duo flow callback endpoint.

Nothing reads the column yet.

For the database reviewer: the column lands on the CE web_hooks table while the consuming feature is EE-only. web_hooks is a small table and PostgreSQL does not rewrite it for a constant default, so this is effectively a metadata-only change.

Where this fits

Part of Duo flow webhook callbacks — letting an external client subscribe to a Duo flow's lifecycle over a normal webhook instead of polling.

This is the base of a stack of five and unblocks the rest: delivery (!249145 (merged)), progress (!251157), create-flow wiring (!249147 (merged)), and the hooks API plus settings checkbox (!249149 (merged)).

References

• Issue: #606803 (closed)
• Reference implementation this was split from (closed PoC): !246849 (closed)

How to set up and validate locally

Nothing to exercise by hand — the column is inert until !249149 (merged) lets you set it. The pipeline's db:migrate and db:rollback jobs plus the structure-dump check cover it.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.