test: verifyHmacSignature and verifyHmacSignatureWithPrefix lack unit coverage

[yashksaini-coder]

Gap

packages/corsair/async-core/webhook-utils.ts exports four verification helpers, but the existing tests/webhook-utils.test.ts only covers two of them:

helper	tested before
verifyHmacSha256Signature	✅
verifySlackSignature	✅
verifyHmacSignature	❌
verifyHmacSignatureWithPrefix	❌

verifyHmacSignature and verifyHmacSignatureWithPrefix are the generic HMAC primitives that back many plugin webhook verifiers via corsair/http, so a regression here would silently weaken signature checks across those plugins.

What coverage should assert

For both helpers:

• fail closed on an empty secret and on an empty signature
• accept a correctly computed signature
• reject an equal-length but non-matching signature (the crypto.timingSafeEqual returns-false path)
• reject a length-mismatched signature — the case where crypto.timingSafeEqual throws and the catch must return false
• verifyHmacSignature: the sha1 algorithm variant
• verifyHmacSignatureWithPrefix: reject a signature missing the expected prefix; accept a valid prefixed signature

Signatures should be computed in-test (no hardcoded secret literals, to avoid the repo secret scanner).

Fix in #1058.