Signing and verifying Tool Webhook payloads with X-Novu-Signature (HMAC-SHA256)

Turn on signing, recompute the HMAC over the raw body, and reject anything that does not match. Plus what the signature does and does not protect.