Function verify_webhook_signature 

pub fn verify_webhook_signature(
    secret: &str,
    body: &[u8],
    header: Option<&str>,
) -> bool

Verify a webhook’s sha256=<hex> HMAC signature over the raw request body.

Constant-time comparison: a byte-by-byte early return would leak the expected digest to anyone willing to time their requests. An absent or malformed header is a rejection, so an unsigned request can never be mistaken for a signed one.