Adds a actions.web_hook.header_allowlist configuration option for configuring the webhook header allowlist.

Related issue(s)

closes #4290

Checklist

• I have read the contributing guidelines.
• I have referenced an issue containing the design document if my change
  introduces a new feature.
• I am following the
  contributing code guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got the approval (please contact
  [email protected]) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added or changed the documentation.

Further Comments

Docs need to be updated (https://www.ory.sh/docs/guides/integrate-with-ory-cloud-through-webhooks#accessing-request-headers) --- unsure what the process is for unreleased changes.