fix api mismatch on rest metadata (#13680)

## Context

This PR fixes a REST API metadata schema mismatch that occurred after
the webhook and apiKey migration from workspace entities to metadata
level.

## The Issue

After PR #13576 deleted the webhook and apiKey workspace entities, the
metadata OpenAPI specification ended up in a broken state:
- The `/metadata` endpoints still had paths for `/webhooks` and
`/apiKeys`
- But the schema definitions were missing (they were previously pulled
from workspace entities)
- This created dangling references in the OpenAPI document

## The Fix

Added proper schema definitions for webhook and apiKey directly in
`computeMetadataSchemaComponents`:
- `Webhook`, `WebhookForUpdate`, `WebhookForResponse`
- `ApiKey`, `ApiKeyForUpdate`, `ApiKeyForResponse`

## Why the CI is Failing

The CI breaking changes detection is comparing:
- **Main branch**: Has a broken OpenAPI document with endpoints that
reference non-existent schemas
- **This branch**: Has the fixed OpenAPI document with proper schemas

The OpenAPI diff tool can't even parse the main branch's document due to
the missing schema references, hence the error -- tested locally

.github/workflows/ci-breaking-changes.yaml

@@ -1,7 +1,10 @@
 name: GraphQL and OpenAPI Breaking Changes Detection
 
 on:
-  pull_request:
+  # Using pull_request_target instead of pull_request to have access to secrets for external contributors
+  # Security note: This is safe because we're only analyzing API schemas and posting comments,
+  # not running untrusted code from the PR
+  pull_request_target:
     types: [opened, synchronize, edited]
     branches:
       - main
@@ -18,6 +21,7 @@ permissions:
   contents: read
   pull-requests: write
   checks: write
+  issues: write
 
 jobs:
   changed-files-check:
@@ -581,6 +585,7 @@ jobs:
         if: always()
         uses: actions/github-script@v7
         with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             const fs = require('fs');
             let hasChanges = false;