Capitalize JWT algorithm used for webhook

While the JWT standard doesn't explicitly say that algorithm names must
be capitalized, all of its examples are capitalized (e.g. 'HS256'
instead of 'hs256').  The lower-case name caused a spurious signature
failure for me.