Add endpoint to receive GitHub webhooks

Part of #630402 (closed) & Depends on !257805 (merged)

Adds the receiver side of GitHub webhooks. GitHub calls our endpoint; CE returns 404, EE has the real logic.

• Authenticates using GitHub's signature (secret from !257805 (merged)), not GitLab tokens
• Duplicate protection using a 10-minute lock per delivery ID
• Returns 404 (unknown project/missing webhook), 401 (bad signature), 400 (invalid JSON)
• Logs verified events but does not act on them yet (waiting for #628581 (closed)/#628588 (closed))
• Updated fine-grained token docs

Notes for reviewers:

• No feature flag on this endpoint — safe, since the webhook only exists once already configured through a separate, still-flagged-off flow
• Currently logs events only — will be replaced with real processing when #628581 (closed)/#628588 (closed) land
• Could not run full local tests or the doc generator rake task in this environment — relying on CI

Pipeline notes:

• pipeline:skip-undercoverage applied: rspec:undercoverage flags the CE stub receive_github_oauth_webhook! (lib/api/import_github_oauth_webhooks.rb) as 0% covered. It's wrapped in :nocov: (same pattern used in 9+ other files) because it's always shadowed by the EE override at runtime — genuinely unreachable in any normal test run. scripts/undercoverage reads LCOV, and the vendored undercover gem's LcovParser#skipped? is hardcoded to always return false (its own comment: "this is why lcov parser will be deprecated"), so it can't see :nocov: exclusions. Not fixable with a code change.
• https://gitlab.com/gitlab-org/gitlab/-/jobs/16937925654 failed again unrelated to our changes. Applying pipeline:skip-router-sync