Expand webhook-utils signature edge case tests

[silentgeckoaudit3801]

Summary

• add webhook signature edge-case coverage for future timestamps inside tolerance
• cover empty �1, reordered headers with extra metadata, and same-length wrong signature rejection
• add a static smoke test that the verifier keeps using imingSafeEqual after the length check

Testing

• Not run locally; this workspace is intentionally avoiding project dependency/toolchain execution.

[silentgeckoaudit3801]

Thanks for reviewing and merging this. PR #267 for issue #253 was also merged in the same campaign window.

Is there an official GrantFox/reward claim or payment step I should complete for these merged Maybe Rewarded issues (#253 and #256)? I want to follow the documented process and avoid posting duplicate claim noise.