add signature to webhooks

[ericls]

No description provided.

[Copilot]

Pull request overview

Adds optional HMAC-based signatures to outgoing webhook requests and updates configuration/docs to support per-endpoint signing keys.

Changes:

• Introduce webhook.Sign and X-Certmatic-Signature header generation (timestamp + HMAC-SHA256).
• Extend webhook dispatcher configuration from URLs []string to Endpoints []Endpoint with optional signing_key.
• Update Caddyfile parsing, in-memory dispatcher delivery, tests, and documentation to reflect signed webhooks.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
README.md	Documents new url { signing_key ... } syntax and links to signature docs.
pkg/webhook/signature.go	Implements signature header construction for webhook deliveries.
pkg/webhook/signature_test.go	Adds unit tests for signature formatting and HMAC correctness.
pkg/webhook/dispatcher.go	Introduces Endpoint struct and updates dispatcher config schema.
internal/webhook/memory.go	Signs requests per-endpoint when SigningKey is configured.
internal/webhook/memory_test.go	Updates existing tests for endpoints and adds signature/no-signature tests.
internal/caddy/config.go	Parses nested signing_key blocks under each webhook url.
internal/caddy/app.go	Wires Endpoints into the dispatcher provisioning path.
docs/webhook-signature.md	Adds standalone documentation for webhook signature verification.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.