VC: Response headers are not signed

[dnkolegov]

Description

According to the validator client API spec: sig is a signature using vc_sk across the sha256 of the response headers + body.

But the implementation signs only the response body: https://github.com/sigp/lighthouse/blob/stable/validator_client/src/http_api/mod.rs#L537

Expected Behaviour

A signature must be produced over HTTP response headers and body.

cc: @Nocasis

[paulhauner]

Hmm, good point. Whilst I wouldn't consider #1269 to be a canonical specification of our signing scheme (I'd point to this instead), you're right that it would make sense that we'd follow the IETF Signature spec and sign across the headers as well as the body (like you suggested). Having a signature across a Date header seems rather useful.

At present, this isn't a vulnerability since we're doing everything we promise in the docs. However, it's a great opportunity for improvement.

This will be a breaking change, so we can't include it in the v1.5.x series. Whilst v1.5.0 is still unreleased, I don't think we should delay the release for this.

Thanks again @dnkolegov, much appreciated.