The BranchProtectionRuleEvent doesn't serialize installation object and its fields, which means that an App consuming that event cannot authenticate to act on the event itself. Github support indicated, and I've confirmed in delivery logs, that the installation field does appear, just as it does in every other webhook event, despite not being documented.