Enforce webhook project and receiver authorization boundaries

[chen21019]

Scope

• Match authenticated control-plane project header to management project query and handle mixed read-only role lists.
• Require webhookReceiver kind for management and signed/public execution paths, including post-filter verification.
• Add role, project, receiver-kind, and signed JWT regression tests; candidate 0.10.2.

Verification

• Go validation, tests including race coverage, build and integration tests passed locally (coverage 80.7%).
• Immutable release/security gate and isolated 8080 integration are still required before publication.