Verify that notifications originate from GitHub

According to GitHub, WebHook POSTs should only ever come from a handful
of addresses. This patch rejects any request that doesn't. If GitHub
changes these addresses in the future, users can adjust their settings
rather than waiting for a new version of leeroy. This feature can be
disabled by setting `WEBHOOK_ADDRESS_WHITELIST` to something falsy.

(The addresses in question are listed on the Service Hooks page.)