fixup: use UntrustedString for app/webhook, Visitor for deserialization

- Use UntrustedString for LSPS5AppName and LSPS5WebhookUrl
- Move URL validation to url_utils for consistency
- Use chars().count() for app name length check
- Remove jsonrpc field from WebhookNotification struct
- Always serialize jsonrpc as 2.0 and Visitor for deserialization
- Avoid heap allocations in WebhookNotification deserialization
- Update tests for new constructors and error types

Author: martinsaposnic