Improve dotnet webhook receiver evidence

[DENGXUELIN]

Summary

• Adds ASP.NET Core inbound webhook receiver evidence gates to the .NET API security supplement.
• Covers raw-body signature verification before JSON parsing, provider header mapping, replay/idempotency, event allowlists, tenant/repository/project binding, environment-scoped secret rotation, and retry-safe side effects.
• Adds vulnerable/benign fixtures for parsing before signature verification versus raw-body verification with idempotency evidence.

Validation

• git diff --check origin/main...HEAD
• Markdown fence-balance check over changed .md files
• Added-line ASCII check
• Content marker check for DOTNET-WH-01, DOTNET-WH-08, ASP.NET Core Inbound Webhook Receiver Evidence Gates, fixture names, Stripe-Signature, and X-GitHub-Delivery
• Added-line secret-pattern scan
• git merge-tree --write-tree origin/main HEAD -> 72c31b9149b2072264e4a58e372f6f7faa533d01

Closes #1796

Requested tier: Improver Moderate (USD 100)