Stripe webhook: reject stale timestamps and accept any v1 signature

This was found while reviewing #51 (PAR-422). It is pre-existing behaviour, moved unchanged into billing/StripeSignature.

• No timestamp tolerance: a captured, validly signed webhook can be replayed at any time. Reject t older than 5 minutes, which is Stripe's default tolerance. The subscription handlers are idempotent, but replaying an old customer.subscription.updated could roll a plan back.
• Only the first v1 is checked: during a webhook-secret rotation, Stripe sends several v1 entries. Accept the request if any of them matches, still comparing in constant time.
• Tests: stale timestamp, future timestamp, several v1 entries with the matching one second, and an empty secret.