pkg/store: add webhook_secret_version and regenerate

[ret2libc]

Slice 2 of 4 — store layer

Persists a per-subscription signing-secret version counter (migration 000009, default 1, no backfill) that the on-demand secret derivation keys on. The secret itself is still never stored.

• Subscription gains WebhookSecretVersion (json:"-", internal bookkeeping). SaveSubscription reflects the persisted version back onto the struct via INSERT ... RETURNING, so a caller deriving the reveal-once secret right after create uses the same version dispatch signs with.
• RegenerateWebhookSecret(id, userID) bumps the counter scoped to the owner and returns the new version (ErrNotFound for missing/not-owner).
• All subscription SELECTs, scanSubscriptionRows, and the ListPendingMatches join carry the new column so dispatch can derive the current secret.

Tests

go test ./pkg/store/... — migration default, version bump + persistence, owner-scoping, and the save-reflects-version contract.

Stack

Part of the signed-webhooks stack — based on #5:

1. cmd/rekor_watch/notifications: add webhook secret deriver #5 crypto libs
2. store ← this PR
3. server: reveal-once secret + regenerate endpoint + UI
4. dispatch signing + docs

🤖 Generated with Claude Code

[ret2libc]

Folded into #7. The store layer here had no consumer on its own — GetSubscription, RegenerateWebhookSecret, and the version column are all first used by the server slice (#7), which now carries both the store and server changes against #5. #7's branch already contained these exact commits, so no work is lost.