feat: Optional Security Headers added for webhook outputs

[SullyK]

• optional security header can be enabled by adding the following to your config:

  "webhookHmacSharedKey": "SomeRandomHMACKey"

(Replace "SomeRandomHMACKey" with your private HMAC secret key)

• when ENABLED, the following headers will be included in the webhook request:

x-hmac-time 1747750828
x-hmac-signature 7420964e60045e716a9b1d4fabcbc6a9cc913c7e63ac653b313d56a097a36d1a
x-request-id 769164d0-5592-4a67-9932-038573732fdc

(example values shown)

--

NOTE:

• THIS MUST USE SHA-256 HASHING ALG
• MESSAGE TO HASH is x-hmac-time + x-request-id (UTF-8 string, no seperators)
• DIGEST OUTPUT is HEX STRING
• x-hmac-time is UNIX EPOCH TIME
• signature is computed using your shared webhookHmacSharedKey
• You MUST validate that the timestamp is within an acceptable range (e.g. 5 minutes) before comparing the HMAC (do this on your backend)

Description

This was done because we want our backend to only accept requests from the running EKS cluster's X-Gov and no one else. There were other ways to do this but they were more involved on the part of L2/L3 support team's AWS account, so this was done instead and is secure enough that it will suffice.

Type of change

• [✓] New feature (non-breaking change which adds functionality)
• [✓] This change requires a documentation update

How Has This Been Tested?

Tested on my local system sending payloads with and without it configured on Google Chrome.

Checklist:

• [✓] I have performed a self-review of my own code
• [✓] I have commented my code, particularly in hard-to-understand areas

[SullyK]

@emilyjevans should be ready.