feat: move GitHub webhook processing into Restate

Thins the HTTP handler to: validate signature → parse payload → send to
Restate → return 200. All DB work moves into a new GitHubWebhookService
(VIRTUAL_OBJECT keyed by installation_id/repo_id) that serializes
processing per repository and retries automatically on failure.

X-GitHub-Delivery is passed as the Restate idempotency key for natural
deduplication of retried deliveries.

Author: Flo4604

gen/proto/hydra/v1/BUILD.bazel

@@ -13,6 +13,8 @@ go_library(
         "deploy_restate.pb.go",
         "deployment.pb.go",
         "deployment_restate.pb.go",
+        "github_webhook.pb.go",
+        "github_webhook_restate.pb.go",
         "key_refill.pb.go",
         "key_refill_restate.pb.go",
         "oneof_interfaces.go",