Slack Notification Webhook: validate before sending

Authenticate the incoming event before parsing it, enforce a replay window, and deduplicate by a stable delivery identifier. Validate an explicit schema and allowlist the destination channel and message template rather than accepting routing fields from the payload. Escape Slack mentions, links and block text so untrusted values cannot notify an entire workspace or break formatting. Keep webhook URLs and signing secrets out of logs. Handle 429 responses using the supplied retry delay, cap retries, and route permanent failures to a review queue.