Accept listed webhook signatures

[aiirvizionz]

Summary

• allow inbound webhook verification to accept space-separated Standard Webhooks signature candidates
• keep constant-time comparison for each candidate and preserve timestamp/id validation

Why

Providers can send multiple webhook-signature values during key rotation. The previous verifier compared the whole header literally, so a valid signature was rejected when it appeared alongside another candidate.

Validation

• npx tsc --noEmit
• signature-list check: valid v1 candidate accepted when listed with an invalid candidate; all-invalid list rejected
• git diff --check