Updating security/webhooks.md to match new behaviour
as well as drying up few specs to extract shared
examples