Verifying webhook signatures the right way: raw body, timing-safe compare, replay window

A webhook is an unauthenticated POST from the internet. Raw body, timing-safe compare and a replay window, with working code for seven frameworks.