Port's ingestion webhooks currently authenticate incoming requests only via a static shared secret validated through HMAC signature checks. This leaves no way to issue short-lived, revocable credentials for webhook senders, which is a blocker for organizations with strict IAM policies against long-lived static secrets. Add support for validating an OAuth 2.0 access token (e.g. client_credentials grant) on inbound webhook requests, used alongside the existing HMAC check rather than replacing it. Without this, security-conscious customers can't onboard ingestion webhooks at all under their compliance requirements.