JWS: implement HMAC SHA-256 validation

Implement JWS HMAC SHA-256 validation.

As a necessary change for validation, add the

    headerRaw :: Maybe ByteString

field to the Header record type.  This field is populated when an
encoded (protected) header is decoded, and its value is preferred
when encoding JSON.  This avoids a Header encode (which could result
in equivalent but different JSON from that from which the value was
decoded) when computing the signing input for MAC/signature
validation.