fix(security): encrypt GitLab webhook token and mask input

Webhook secret was stored and shown as plaintext. Use a password field,
encrypt at rest (with legacy plaintext read support), and look up tokens
via findByWebhookToken so encrypted values still authenticate webhooks.

app/Http/Controllers/Webhook/Gitlab.php

@@ -103,7 +103,7 @@ class Gitlab extends Controller
                 ], 401);
             }
 
-            $gitlab_app = GitlabApp::where('webhook_token', $x_gitlab_token)->first();
+            $gitlab_app = GitlabApp::findByWebhookToken($x_gitlab_token);
             if (! $gitlab_app) {
                 auditLogWebhookFailure('gitlab', 'invalid_token', [
                     'event' => $object_kind,