Add Support for Signature Validation via HTTP Header

[tsconn23]

For context, see comment here:

alvarium-sdk-go/internal/annotators/pki.go

Line 67 in 884bf5e

// The question of how/whether to validate signed data is tricky. We want this SDK to be as agnostic of the application data

Essentially, our current PKI annotator has some constraints in that incoming data must support unmarshaling via JSON to a type that has a Signature property. This eliminates our ability to annotate data that is not in JSON format or otherwise does not provide the necessary property. We need to leverage a means independent of the data payload for this capability and so I propose looking for some way to leverage the means of transport.

The following IETF draft proposes using HTTP headers to support signature validation.
https://httpwg.org/http-extensions/draft-ietf-httpbis-message-signatures.html

Assuming the relevant Signature and Signature-Input headers are present, in an HTTP context the Request can be passed into the annotator which would obtain the values and run the verification. Using headers would also possibly provide insight toward a relevant abstraction for a similar means of verification in pub-sub scenarios where message headers are available.