[feature] Try HTTP signature validation with and without query params for incoming requests

[tsmethurst]

Description

If this is a code change, please include a summary of what you've coded, and link to the issue(s) it closes/implements.

If this is a documentation change, please briefly describe what you've changed and why.

This pull request addresses the first part of #894 by implementing code to fall back to excluding query params when validating incoming HTTP signatures. The "default" first-attempt behavior (including query params when reassembling signature strings) remains the same.

Checklist

Please put an x inside each checkbox to indicate that you've read and followed it: [ ] -> [x]

If this is a documentation change, only the first checkbox must be filled (you can delete the others if you want).

• I/we have read the GoToSocial contribution guidelines.
• I/we have discussed the proposed changes already, either in an issue on the repository, or in the Matrix chat.
• I/we have performed a self-review of added code.
• I/we have written code that is legible and maintainable by others.
• I/we have commented the added code, particularly in hard-to-understand areas.
• I/we have made any necessary changes to documentation.
• I/we have added tests that cover new code.
• I/we have run tests and they pass locally with the changes.
• I/we have run go fmt ./... and golangci-lint run.

[daenney]

The one thing maybe worth considering here is caching which of the two verify schemes worked for a domain, so we don't always have to try both for a particular domain if it happens to want the second scheme.

[NyaaaWhatsUpDoc]

The one thing maybe worth considering here is caching which of the two verify schemes worked for a domain, so we don't always have to try both for a particular domain if it happens to want the second scheme.

have squerged for now as i think compared to the other side of attempting both times of httpsigs this is less of a priority, at least re: tobi being able to get on with the other Move work. though definitely a low-hanging fruit performance gain