feat: add webhook URL validation with configuration scheme allowlist

[ayomideaccess]

Closes issue #129

What

Adds validation for webhook_url in the payments module by:

• Enforcing a maximum length of 2048 characters
• Making the list of allowed URL schemes configurable through the ALLOWED_WEBHOOK_SCHEMES environment variable
• Defaulting to https when the environment variable is not set

Why

The previous implementation used hardcoded URL scheme validation and did not enforce the maximum URL length required by the issue. This change makes the validation more flexible while ensuring the missing length constraint is applied.

How to Test

Run with both HTTP and HTTPS enabled:

ALLOWED_WEBHOOK_SCHEMES=https,http cargo run

Run without setting ALLOWED_WEBHOOK_SCHEMES to verify that only https URLs are accepted.