Webhook surfaces accept all events when no filter is set

A webhook surface configured with an empty event list (the default for generated webhook surfaces) was treating the empty list as an allowlist and rejecting every payload that carried an event or type field with 400 Event not allowed. Only a non-empty event list acts as a filter now, on both the generic webhook endpoint and the per-event variant.