Added support for webhook authentication

[txrp0x9]

Adds a verification_token field to the crawl URL, used with the webhook field. It accepts a nonce string for the server to verify upon receiving webhooks, ensuring they originate from a legitimate source.

Adds HMAC-SHA256 verification on webhooks
If provided with a "secretKey" in the request body, the webhook response will now contain a header,
"Webhook-Signature": "sha256=<hash>"
The <hash> being a SHA256 hash with the secretKey on the raw request body string.

Example of verifying the request body with express.js
Make sure to use the body string before it is parsed to JSON (JSON.parse() or equivalent). Ideally in a middleware.

Fixes #813

[txrp0x9]

While this solution does mimic the version described in the #813, It can be computationally expensive.
A better solution might just be passing the secret in the response body, instead of hashing it (the secret can be a uuid)
Why? If the secret is leaked, the authentication is broken, so as long as the secret remains safe, that is, the client and server are the only ones who know it, hashing the request body may not be necessary
unless
the request body is susceptible to MITM attacks which can lead to the body being changed, but with HTTPS this should be less of a worry (not non-existent however)

Please let me know if I'm missing something.

We're now going with a simple verification_token method

[nickscamara]

@rafaelsideguide can you review this when you get a chance? tks!

[rafaelsideguide]

the response still using snake case

[txrp0x9]

Renaming seems to have broken something, results have become unpredictable, I'll fix this in a moment.
@rafaelsideguide Could you pllease test this on your system and let me know if its fine

[Nurfen]

Plus one for this update, we can't use webhooks without basic security features