Validate Webhook

Webhook create/update body. body, headers, and queryParams only take effect for services that issue a templated HTTP request (generic, incidentio). The slack service posts a fixed payload to its incoming-webhook URL and ignores them, so supplying any of these fields on a slack webhook is rejected. headers and queryParams are write-only — they are accepted here but never returned by any read endpoint, so secrets such as auth tokens do not leak. On update (PUT), omitted readable fields (description, body) are cleared, while omitted headers/queryParams are preserved — send an explicit {} to clear them. Exception: if the destination (url or service) changes, omitted headers/queryParams are cleared rather than preserved, so stored secrets are never forwarded to a new destination; re-supply them for the new destination.