fix(webhooks): verify HMAC signatures

[msabenda]

Summary

Adds secure HMAC-SHA256 signature verification to webhook handling in the Snippe PHP SDK.

Previously, Webhook::capture() parsed incoming webhook requests without verifying that they originated from Snippe. A forged request containing X-Webhook-Event: payment.completed could potentially be treated as a legitimate payment event.

Changes

• Require a webhook secret when capturing webhook requests
• Verify X-Snippe-Signature using HMAC-SHA256
• Compare signatures using the constant-time hash_equals() function
• Reject missing, malformed, and invalid signatures with HTTP 401
• Calculate signatures against the exact raw request body
• Require the signed payload status to agree with X-Webhook-Event
• Validate decoded JSON payload types
• Safely handle malformed optional webhook fields
• Update webhook documentation and usage examples
• Add tests covering successful and failed signature verification

Signature Contract

Header: X-Snippe-Signature
Format: sha256=<hexadecimal HMAC>
Algorithm: HMAC-SHA256
Signed content: Exact raw HTTP request body