Validate webhook's payload

[stsewd]

I tested it with github and gitlab, it works, I'm returning a 403 when the payload isn't valid.

Close #4886

[humitos]

Looks good for now.

[codecov]

Codecov Report

Merging #4940 into master will decrease coverage by 0.03%.
The diff coverage is 89.7%.

@@            Coverage Diff             @@
##           master    #4940      +/-   ##
==========================================
- Coverage   76.85%   76.82%   -0.04%     
==========================================
  Files         158      158              
  Lines        9991     9998       +7     
  Branches     1254     1248       -6     
==========================================
+ Hits         7679     7681       +2     
- Misses       1978     1984       +6     
+ Partials      334      333       -1

Impacted Files	Coverage Δ
readthedocs/restapi/views/integrations.py	93.33% <100%> (+1.37%)	⬆️
readthedocs/oauth/services/base.py	47.31% <100%> (+1.15%)	⬆️
readthedocs/projects/forms.py	79.44% <50%> (-0.56%)	⬇️
readthedocs/oauth/services/gitlab.py	52.53% <50%> (-0.04%)	⬇️
readthedocs/integrations/models.py	81.56% <60%> (-0.73%)	⬇️
readthedocs/integrations/utils.py	43.75% <75%> (-18.75%)	⬇️
readthedocs/oauth/services/github.py	43.31% <83.33%> (-0.28%)	⬇️
readthedocs/vcs_support/backends/svn.py	29.5% <0%> (-9.89%)	⬇️
readthedocs/core/utils/__init__.py	74.73% <0%> (-5.68%)	⬇️
... and 14 more

[stsewd]

So, there are a couple of decisions here. I'm generating a secret by default, when applying the migrations, all the integrations will have a secret, and we don't want that, because those don't have a secret set on github/gitlab.

Also, when users create a webhook, a secret is generated, but they can't see the secret, so the can't create a webhook manually.

I can suggest these things:

• Only generate a secret when creating a webhook using the provider's api
• Let the user see the secret (it can't be changed by the user), or we can let the user change this value too, so they can set up a secret on their own, or don't let the user see the secret and only generate one when creating an integration using the provider's api.

[stsewd]

So, I changed the code to only create a secret when rtd create the webhook, if the user creates the webhook manually it can't set a secret. Also, users can't see the secrets right now.

[ericholscher]

Believe this is ready 👍 We likely need to update the migration names tho.

[stsewd]

Merged with master, migrations are still valid