feat: jws signature validation

[dav1do]

Implements event validation using did:key/JWS. This verifies the envelope and makes sure the cacao grants access to the key that signed the payload. This builds on #495 (current target) and I had to make the cacao/pkh Verifier async since it can be a JWS based on the metadata.

This is not invoked anywhere and the tests currently only verify signatures for the valid events from the ceramic-sdk test vectors.