fix(websub): reject malformed signature headers

[rissrice2105-agent]

Summary

• require WebSub distribution signatures to use an exact algorithm=hex-digest format
• verify the digest length before converting it to bytes
• cover invalid hex suffixes, odd trailing nibbles, and extra separators

Bug

Node's Buffer.from(value, 'hex') silently truncates malformed input. As a result, a valid HMAC followed by characters such as zz, an extra nibble, or =ignored was accepted as the original signature.

Tests

• vitest run packages/w3c/websub/src/index.test.ts: 13/13 passed
• WebSub package TypeScript check: passed
• git diff --check: passed

No invoice will be sent unless this PR is merged and accepted.