Verify Nylas webhook signatures to prevent forged events

Nylas webhooks require two security checks: an endpoint challenge during setup and cryptographic signature verification on each payload. The challenge proves you control the URL, while the signature ensures the data is genuine and untampered. Skipping signature verification leaves your endpoint vulnerable to accepting forged POST requests.