Configures the outbound event webhook. The endpoint URL is validated (must be https and must not resolve to an internal/private/metadata address). Omit customHeaderValue to keep the stored secret. The events.* keys use the getWebhookEventTypes vocabulary (emailReported, payloadClicked, deliveryFailed, trainingFailed) so they match getWebhook's response 1:1.