fix: reject a webhook secret below the server's 16-character floor

[rmyndharis]

What

The server enforces a 16-character floor on webhook secrets at registration (0.20.0+). The node forwarded the secret verbatim, so a short one failed as a raw 400 in the middle of a workflow activation, with nothing pointing at the field that caused it.

This adds the same up-front validation the node already applies to empty event lists and blank path parameters, in the three places a secret reaches the server:

• the trigger's create hook, which runs at workflow activation
• Webhook Create on the action node
• Webhook Update on the action node, when rotating the secret

All three now fail with Webhook secret must be at least 16 characters before any request is sent. The field descriptions and the README state the floor and the server version it gates on.

Deliberately unchanged

• The delivery verification path still accepts any secret length, so a webhook registered with a legacy short secret before the floor keeps verifying until it is re-registered.
• An empty secret still means "unsigned" everywhere, and Webhook Update still ignores an empty string rather than clearing the server-side secret.

Tests

Three new cases cover the guards (trigger create, action create, action update) and assert no HTTP call is made when one trips; existing fixtures that registered short secrets were moved past the floor. Full suite: 299 passing.