docs: add info for webhook signature validation

[melissahenderson]

This was requested by Radu. He and Max may be good resources if there are questions.

If an ASE wants to use a signature, the SIGNATURE_SECRET environment variable is optional, so the ASE can opt in or opt out. We should point this out in the Admin API(s) and somewhere in the Webhook Events page, rather than making signatures its own page.

For the webhooks, Radu suggested something like this as well as code snippets.

1. Go to https://docs.stripe.com/webhooks?lang=node&verify=verify-manually#verify-official-libraries
2. Click the Verify Manually tab

The steps in the Stripe doc are:

1. Extract the timestamp and signatures from the header (in our case the timestamp is in the Rafiki-Signature header)
2. Prepare the signed_payload string (in our case, the payload string is the request body [the data Rafiki sends to the ASE])
3. Determine the expected signature
4. Compare the signatures

[brad-dow]

Adding this content to the Webhook Events page before adding to any of the API pages. Adding @raducristianpopa and @mkurapov to the PR to verify this information first.

Need to learn more about how (or if) signatures are used across Rafiki for other services and if the logic is the same. Looks like Auth Admin API has its own signature variables as well.