Add scheme-based webhook signature verification (HMAC-SHA1, secret_from, URL reconstruction)

[Copilot]

• Explore repository structure and existing webhook_verify implementation
• Add scheme-based verification (hmac-sha1, hmac-sha256, hmac-sha256-hex)
• Add secret_from resolution, url_reconstruction, include_form_params, error_status
• Fix: reserved keys (steps/trigger/meta) in resolveSecret set last so user-controlled pc.Current data cannot override them
• Fix: reconstructURL falls back to request scheme (req.TLS/URL.Scheme) instead of hardcoding "https"; handle comma-separated X-Forwarded-Proto/X-Forwarded-Host headers
• Add 3 new tests: reserved-key override prevention, comma-separated forwarded headers, request-scheme fallback
• All 31 tests pass, lint clean

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[Copilot]

Pull request overview

Adds a new scheme-based configuration mode to step.webhook_verify to support additional webhook signature formats (Twilio HMAC-SHA1, generic HMAC-SHA256, GitHub sha256=-prefixed hex), while keeping the legacy provider-based configuration intact.

Changes:

• Implement scheme-based verification, including secret_from dotted-path resolution and optional URL reconstruction / form-param signing input.
• Extend unit tests to cover new schemes, secret_from, URL reconstruction, and configurable error HTTP status.
• Update wfctl step type registry to reflect the new configuration keys.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
module/pipeline_step_webhook_verify.go	Adds scheme-based config path (scheme, secret_from, signature_header, URL reconstruction, Twilio signing input, error status).
module/pipeline_step_webhook_verify_test.go	Adds scheme-based test coverage for HMAC-SHA1(base64), HMAC-SHA256(hex), GitHub prefix handling, secret_from, and error_status.
cmd/wfctl/type_registry.go	Updates CLI-known config keys for step.webhook_verify to include new scheme-based fields.

[intel352]

@copilot apply changes based on the comments in this thread