Protect the Curry PubSubHubbub callback.

Supermarket now understands an additional environment variable, the
PubSubHubbub secret. Outside of development, we reject outright any
requests that don't bear the correct signature.

Note that we must use the bleeding edge Octokit library. No release on
Rubygems has an Octokit::Client#subscribe which takes the optional hub
secret parameter.