Legacy API: disallow new webhook creation

These are a mess and no one uses them, so let's keep it that way and
skip re-implementing all of this properly.

todosrht/blueprints/api/tickets.py

@@ -121,6 +121,8 @@ def _webhook_filters(query, username, tracker_name, ticket_id):
     return query.filter(TicketWebhook.Subscription.ticket_id == ticket.id)
 
 def _webhook_create(sub, valid, username, tracker_name, ticket_id):
+    if current_token.token_partial != "internal":
+        abort(401)
     user = get_user(username)
     tracker, _ = get_tracker(user, tracker_name, user=current_token.user)
     if not tracker:

todosrht/blueprints/api/trackers.py

@@ -67,6 +67,8 @@ def _webhook_filters(query, username, tracker_name):
     return query.filter(TrackerWebhook.Subscription.tracker_id == tracker.id)
 
 def _webhook_create(sub, valid, username, tracker_name):
+    if current_token.token_partial != "internal":
+        abort(401)
     user = get_user(username)
     tracker, access = get_tracker(user, tracker_name, user=current_token.user)
     if not tracker: