Webhook signing and verification

Proving an inbound callback came from the expected sender and arrived unaltered, typically with an HMAC computed over the exact request bytes plus a signed timestamp that bounds replay.