Verify Github webook secrets

This ensures that the hooks actually come from Github, see:
  https://developer.github.com/webhooks/securing

The fictional `github >= 0.11.2` I'm depending on will hopefully be the outcome of https://github.com/jwiegley/github/pull/79#issuecomment-61848158.
The bound should be >= 0.12, after the updated version of github package has been released.