Support webhook shared secrets

[konklone]

GitHub lets you put a shared secret into a webhook, that the server can use to verify that it's really GitHub making the request.

hookshot should support this. I'll plan to do a PR, but putting this flag in the sand in case someone wants to beat me to it.

[TooTallNate]

+1, docs are explained in https://developer.github.com/webhooks/