v10.10.1

Fixes

Compare webhook signatures in constant time

The webhook parser compared the computed HMAC with the signature from the request
header using string inequality, which returns at the first differing character. That
leaks how many leading characters matched, making signature verification a
per-character oracle for forging a signature.

The comparison is now constant time, matching every other GoCardless client library.