Update webhooks sample to use hmac.compare_digest to validate signatures