Mask webhook URLs with url_variables placeholders on create

Closes #6776. Related to #6856 (closed) and gitlab#587029.

gitlab_group_hook and gitlab_project_hook could not create a hook whose url contains {key} placeholders. The provider created the hook with the url alone and set the URL variables afterwards, so GitLab rejected the placeholders with 422 {error: Invalid url given}. Passing the secret in a plain URL with url_variables never masks it either, because GitLab does not swap a plain URL for placeholders (gitlab#587029).

This MR follows the REST sequence from #6856 (closed), which works with the current API and client-go:

1. Create the hook with the URL filled in from the url_variables values.
2. Set each URL variable (PUT .../hooks/:hook_id/url_variables/:key).
3. Edit the hook to set url to the template. GitLab accepts it now that the variables exist, and stores and returns the masked URL. The token is sent again in this call, because GitLab resets it when the URL changes.

Plain URLs keep today's behaviour. Also:

• A {key} placeholder with no matching url_variables entry fails at plan time.
• Changing the value of a URL variable that the url references forces re-creation. GitLab clears URL variables when the filled-in URL of an existing hook changes, so it would reject an in-place update. Unreferenced variables still update in place.
• Docs and examples show the placeholder form.

The hook create and update endpoints already accept url_variables (common_hook_parameters in lib/api/helpers/web_hooks_helpers.rb), but client-go's Add*HookOptions and Edit*HookOptions don't have the field yet. gitlab-org/api/client-go!3151 (merged) adds it. Once it's released, this can become a single create call, as in the UI.

Tests: new TestAcc{Project,Group}Hook_urlVariablesPlaceholders. The project test passes against GitLab CE 19.5.1 and fails on main with the 422. The group test needs EE and hasn't run locally.