httpsig v1.6.0

@hellocoop/httpsig 1.6.0

Added

• returnSent fetch option — when passed returnSent: true, fetch() returns { response, sent }, exposing the signed request that actually went on the wire (method, url, headers including Signature/Signature-Input/Content-Digest, body) for logging and audit.

This is a non-breaking, additive change. The option defaults to false; existing callers continue to receive a plain Response with no behavioral change. TypeScript overloads now return more precise types per option (dryRun → { headers }, returnSent → { response, sent }, neither → Response).