Webhook service: allow writes to /etc/caddy

git pull inside the deploy needs to update .git/FETCH_HEAD, but
ProtectSystem=full makes /etc read-only. ReadWritePaths=/etc/caddy
opens just the repo directory.

scripts/webhook/caddy-deploy-webhook.service

@@ -9,6 +9,7 @@ Restart=on-failure
 RestartSec=2
 User=root
 ProtectSystem=full
+ReadWritePaths=/etc/caddy
 ProtectHome=true
 NoNewPrivileges=true
 PrivateTmp=true