Add SAFE-T1901: Outbound Webhook C2

[saurabh-yergattikar]

Summary

This PR adds the new Command & Control technique SAFE-T1901 – Outbound Webhook C2, expanding SAFE-MCP coverage of C2 tactics.

Details

• Describes how adversaries abuse outbound HTTP webhooks as covert command-and-control channels in MCP environments.
• Mapped to MITRE ATT&CK T1567.004 (Exfiltration Over Webhook).
• Includes validated references (MITRE, CISA, HackerOne, Invicti).
• Provides detection guidance (network + host indicators + Sigma rule).
• Adds practical mitigations (egress allow-listing, proxy filtering, signed webhooks).

Validation

✅ Markdown validated locally
✅ DCO sign-off included
✅ Root README table linked to /techniques/SAFE-T1901/README.md
✅ Follows SAFE-MCP Contributor Guide format

Type of Contribution

• ✅ New Technique
• New Mitigation
• Update to existing content
• Documentation improvement

Checklist

• DCO sign-off included in commits (git commit -s)
• For technique contributions: see TEMPLATE-CHECKLIST.md
• For mitigation contributions: see TEMPLATE-CHECKLIST.md

Related Issues

Closes #[issue-number] (if applicable)