[CON-239] Add support for incoming source verification when the signature is in the body

[jirevwe]

Some providers like MailGun provide the webhook token in the body of the webhook rather than in the request headers. Reference documentation

{
  "signature": {
    "token": "66b79a5fa3aa2865a2a5bf3f2d8c27b02c5054896aebd9801e",
    "timestamp": "1702637050",
    "signature": "0b0003830ca6431d4b9582784f5ab0e06cb16a58f017e93751b1978941e111a1",
  },
  "event-data": {
    ...
  }
}

_CON-239

[linear]

CON-238 Add support for incoming source verification when the signature is in the body