feat(api): add SIP media security to incoming call events (#3907)

## Summary

Expose optional SIP media-security metadata in incoming webhook event
data.

## Changes

- Read `sip_media_security` on incoming live-call, live-transport, and
realtime-call events.
- Accept `rtp`, `srtp`, and future string values while allowing the
field to be omitted.
- Document that this describes negotiated SIP-leg media protection, not
signaling security or proof that media has flowed.