Use asym key to sign webhooks

[anbraten]

closes #865

• use public private key for http signing
• generate global ed25519 key pair
• save generated key pair to db and load on next restart
• add endpoint for getting public key
• add migration notice
• update docs
• update sample config service => will be done after merging this to not confuse users

[woodpecker-bot]

Deployment of preview was successful: https://woodpecker-ci-woodpecker-pr-916.surge.sh

[codecov-commenter]

Codecov Report

Merging #916 (932edb1) into master (e172b66) will decrease coverage by 0.33%.
The diff coverage is 44.88%.

❗ Current head 932edb1 differs from pull request most recent head 8fc107b. Consider uploading reports for the commit 8fc107b to get more accurate results

@@            Coverage Diff             @@
##           master     #916      +/-   ##
==========================================
- Coverage   51.63%   51.29%   -0.34%     
==========================================
  Files          79       81       +2     
  Lines        6075     6158      +83     
==========================================
+ Hits         3137     3159      +22     
- Misses       2756     2815      +59     
- Partials      182      184       +2     

Impacted Files	Coverage Δ
cmd/agent/agent.go	0.00% <0.00%> (ø)
server/grpc/rpc.go	0.00% <0.00%> (ø)
server/grpc/server.go	0.00% <ø> (ø)
server/queue/persistent.go	0.00% <0.00%> (ø)
server/queue/queue.go	63.26% <ø> (ø)
server/store/datastore/migration/migration.go	37.50% <ø> (ø)
server/plugins/utils/http.go	22.41% <22.41%> (ø)
server/store/datastore/server_config.go	69.23% <69.23%> (ø)
server/grpc/filter.go	100.00% <100.00%> (+13.63%)	⬆️
server/queue/fifo.go	83.13% <100.00%> (ø)
... and 4 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a2ca657...8fc107b. Read the comment docs.

[6543]

could you have a look at https://github.com/go-ap/httpsig since the maintainer of the new used lib do not have time to maintain (one-man-show) ...

[anbraten]

So should I try to replace https://github.com/go-fed/httpsig with https://github.com/go-ap/httpsig?

[anbraten]

I adjusted the code to use https://github.com/go-ap/httpsig