Rotate the signing secret for a webhook destination. A new signing secret is generated and returned.

The previous secret remains valid for a grace period (indicated by previousSecretExpiresAt on the webhook destination) to allow for a seamless transition. During this period, webhook deliveries include signatures for both the old and new secrets.