feat: implement hmac authentication for create-* and sign-* endpoints

[rorp]

This PR introduces a simple out-of-the-box HMAC authentication and authorization scheme for write operations, which are currently wide open.

It introduces a non-optional KORMIR_HMAC_SECRET environment variable to define an HMAC secret. Authentication can be disabled by setting the KORMIR_HMAC_SECRET environment variable to none.

The server expects the client to send a hex-encoded HMAC signature, generated using the same secret, in the X-Signature HTTP request header.

[bennyhodl]

Thanks! #26 will fix the CI issue