SourceGitHub: validate payload signature

[dregad]

As webhooks are now the standard way to notify the plugin whenever commits are pushed to the repository (see #292), we should implement support payload validation, as described in webhooks documentation.

This requires a new repository config to store the webhook secret key used to salt the payload hash, and additional processing in the precommit hook.