Use the webhook secret on webhook creation and check it and webhook receive
Additionally don't save a CloneURL field inside the project type. If in future some git source doesn't provide a clone url we could just calculate it from project.RepoPath or call the remote api to retrieve it.
* Generalize to use repopath instead of (owner, reponame)
