fix: reconcile webhook token rotation for group and project Hook

[markussiebert]

Description of your changes

Fixes #374. Reconciles webhook token rotation for both the group Hook and the project Hook, plus two related project-Hook consistency fixes.

Token rotation (group + project)

GitLab never returns the webhook secret, so IsHookUpToDate can't compare it and Update only ran when some other field drifted. Rotating only the referenced secret was therefore never propagated.

The change detects rotation on the desired side:

• New status.atProvider.tokenHash holds a SHA-256 digest of the token last pushed (never the raw token), via a shared clients.TokenHash helper.
• Observe resolves the secret — only when every other field already matches — and compares its hash to the stored one; a mismatch drives Update.
• Update re-pushes the token and rewrites the digest.
• The hash is written in Update (crossplane-runtime reverts status changes made during Create), so a freshly created hook with a token self-corrects via a single Update.

Project Hook consistency (mirroring the group Hook)

• Enforce projectId immutability with a CEL XValidation rule.
• Remove the dead errHookNotFound / IsErrorHookNotFound matcher (GitLab returns "404 Not Found"; not-found is already handled by clients.IsResponseNotFound on the response status).

How has this code been tested

go build ./..., go vet ./..., go test ./... all pass; new unit tests cover the token-rotation path (TokenRotated) and hash persistence for both hooks (namespaced + generated cluster variants).

Live e2e on a self-managed GitLab 18.11.5-ee group (provider out-of-cluster against a kwok control plane): created a group hook with a token, then rotated only the referenced secret. The reconciler detected the change and issued an Update — status.atProvider.tokenHash moved from sha256(v1) to sha256(v2) — confirming the previously-broken path now works. All sandbox resources were cleaned up afterward.

Delete by external-name (group + project)

Delete used status.atProvider.ID for the hook id while Observe/Update derive it from the external-name. If the resource was deleted before a successful Observe populated atProvider.ID, that id is 0 and Delete would call DeleteHook(..., 0), orphaning the real webhook. Delete now parses the hook id from the external-name, matching Observe/Update.