Updates an existing webhook endpoint and returns the updated resource.

Only the fields included in the request body are changed — omitted fields keep their current value. A few notes:

• url must use HTTPS; private/internal IP ranges are rejected (the same validation applied at creation).
• events, if provided, must be a non-empty array of valid event types and fully replaces the existing list.
• Setting enabled: true clears any auto-disabled state left by repeated delivery failures and resets the consecutive-failure count. It does not otherwise change status; use the resume endpoint to fully reactivate a paused endpoint.
• The shared secret is never returned here — the full value is shown only once, at creation. The response includes only a secret_prefix.