feat: add support for ECDSA keys to be used with SubtleCrypto.prototype.sign and SubtleCrypto.prototype.verify

[JakeChampion]

In the last release we added support for importing an ECDSA key with SubtleCrypto.prototype.importKey. This patch adds the ability to use these keys to sign data and to verify data was signed with the same underlying key.

With this patch, Fastly Compute customers are now able to validate signatures provided by Fastly Fanout requests

fixes #663

Here is an example of how a Fastly Customer can verify Fastly Fanout requests:
https://fanout-cf.edgecompute.app/

/// <reference types="@fastly/js-compute" />

import { createFanoutHandoff } from "fastly:fanout";
import { env } from 'fastly:env';
import { importJWK, jwtVerify } from "jose";

// A JWK version of the public key documented on https://developer.fastly.com/learning/concepts/real-time-messaging/fanout/#validating-grip-requests
const fanoutJWK = importJWK({
  kty: "EC",
  crv: "P-256",
  x: "CKo5A1ebyFcnmVV8SE5On-8G81JyBjSvcrx4VLetWCg",
  y: "7gwJqaU6N8TP88--twjkwoB36f-pT3QsmI46nPhjO7M",
}, "ES256");

async function app(event) {
  console.log('FASTLY_SERVICE_VERSION', env('FASTLY_SERVICE_VERSION'));

  const request = event.request;

  // Request might be from Fanout
  if (request.headers.has('Grip-Sig')) {
    try {
      const { payload, protectedHeader } = await jwtVerify(request.headers.get('Grip-Sig'), await fanoutJWK)

      return Response.json({ payload, protectedHeader }, { 'headers': { 'content-type': 'application/json' } });
    } catch (error) {
      return Response.json({ error }, { status: 500 });
    }
  } else {
    // Not from Fanout, hand it off to Fanout to manage
    return createFanoutHandoff(request, 'self');
  }
}

addEventListener('fetch', event => event.respondWith(app(event)))

[elliottt]

🚀