Function verify_signature 

pub fn verify_signature(
    payload: &[u8],
    signature_header: &str,
    secret: &str,
) -> bool

Verify an HMAC-SHA256 webhook signature using constant-time comparison.

• payload - raw request body bytes
• signature_header - value of the X-Signature header (hex-encoded HMAC)
• secret - shared secret from GHL Marketplace app settings