Add webhook signature and timestamp validation methods

[blairlunceford]

First SDK pass at adding webhook signature and timestamp validation methods.

I broke up the two methods to give users options, but we could also combine them into one validation method.

I assume that the application will parse the request for the raw POST body and the signature like:

sig_header = request.headers['WorkOS-Signature']
payload = request.body.read

And then enter the parsed information as parameters to the methods, along with the Webhook Secret.

[linear]

SDK-235 Add webhook signature and timestamp validation methods to Ruby SDK

[codecov-commenter]

Codecov Report

Merging #113 (e76dcf3) into master (4df26ca) will increase coverage by 0.04%.
The diff coverage is 98.66%.

@@            Coverage Diff             @@
##           master     #113      +/-   ##
==========================================
+ Coverage   98.26%   98.30%   +0.04%     
==========================================
  Files          28       31       +3     
  Lines         575      650      +75     
==========================================
+ Hits          565      639      +74     
- Misses         10       11       +1     

Impacted Files	Coverage Δ
lib/workos/webhook.rb	94.11% <94.11%> (ø)
lib/workos.rb	100.00% <100.00%> (ø)
lib/workos/errors.rb	96.29% <100.00%> (+0.14%)	⬆️
lib/workos/types.rb	100.00% <100.00%> (ø)
lib/workos/types/webhook_struct.rb	100.00% <100.00%> (ø)
lib/workos/webhooks.rb	100.00% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4df26ca...e76dcf3. Read the comment docs.

[mthadley]

Overall, this looks awesome!

Really happy to see that we'll implement this verification process for our users. I think it'll be great to have these security best-practices built-in to our SDK's.

Only thing that I think we need to change is to use a constant time algorithm when comparing the two digests. See the comment I left there for suggestions.