Add a normative link to the httpsig RFC

[michielbdejong]

I think when we say 'httpsig' in our internet draft, what we are referring to is RFC 9421 right?
We should probably add a normative link to it