Use SHA256 for GitHub Webhook

(#298 seems abandoned but we should still do it.)

GitHub [now sends SHA256-encrypted webhooks](https://docs.github.com/en/developers/webhooks-and-events/webhooks/securing-your-webhooks#validating-payloads-from-github) ... let's validate those and sunset the SHA1 validation.