Webhook signature verification.

Corvo signs every webhook delivery with HMAC-SHA256 over the raw request body using your endpoint secret, and sends the hex digest in the X-Corvo-Signature header as sha256=<hex>.

Example

{:ok, raw_body, _conn} = Plug.Conn.read_body(conn)
[signature] = Plug.Conn.get_req_header(conn, "x-corvo-signature")

true = CorvoNfse.Webhooks.verify_signature(raw_body, signature, secret)

Always verify against the raw body, before any JSON parsing or re-serialization. Comparison is constant-time (:crypto.hash_equals/2).