Add verify_webhook_signature helper for webhook authenticity

[roznawsk]

Description

Adds verify_webhook_signature(body, signature, secret) to fishjam: verifies the x-fishjam-signature-256 header (GitHub-style sha256=<hex> HMAC-SHA256 of the raw body, prefix optional) using hmac.compare_digest for constant-time comparison. Exported next to decode_server_notifications; call it on the raw request body before decoding.

Motivation and Context

Fishjam now signs webhook notifications. Without an SDK helper, users hand-roll verification with ==, which is timing-attackable. Same helper already added to the JS server SDK.

Documentation impact

• Documentation update required
• Documentation updated in another PR
• No documentation update required

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to
  not work as expected)

[Copilot]

Pull request overview

Adds a public helper to verify Fishjam webhook authenticity by validating the x-fishjam-signature-256 HMAC-SHA256 signature against the raw request body, complementing the existing webhook decoding utilities in fishjam.

Changes:

• Added verify_webhook_signature(body, signature, secret) using hmac.compare_digest for constant-time comparison.
• Exported the helper from fishjam.__init__ alongside existing webhook helpers.
• Added unit tests covering valid signatures (with/without sha256= prefix) and common failure cases.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
fishjam/_webhook_notifier.py	Implements verify_webhook_signature for validating signed webhook bodies.
fishjam/__init__.py	Re-exports verify_webhook_signature as part of the public SDK API.
tests/test_webhook_notifier.py	Adds test coverage for signature verification success/failure scenarios.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.