feat: Hookdeck webhook signature verification

[leggetter]

Adds the ability to verify the Hookdeck webhook signature.

const headers = request.headers;
const rawBody = await request.text();
const result = await verifyWebhookSignature({
    headers,
    rawBody,
    signingSecret: process.env.HOOKDECK_SIGNING_SECRET,
})

if(!result.isValidSignature) {
    // Reject the webhook payload
}
else {
    // Proceed with the webhook payload
}

Also check that Hookdeck verified the initial request from the Source.

const headers = request.headers;
const rawBody = await request.text();
const result = await verifyWebhookSignature({
    headers,
    rawBody,
    signingSecret: process.env.HOOKDECK_SIGNING_SECRET,
    config: {
        checkSourceVerification: true,
    }
})

if(!result.isValidSignature) {
    // Reject the webhook payload
}
else {
    // Proceed with the webhook payload
}

[chadxz]

LGTM. I wonder if the user may want this to never throw, though. In that case all the errors would be turned into like debug logs and instead return false for valid signature. Just a thought.

You may also want to check the shape of your error to make sure the name, stack trace etc look how you want them to look.