Properly verify challenge requests

[dylmye]

We should verify signatures properly, rather than just returning challenges without checking they're authentic. It's not likely to be a major problem for this use-case because client IDs aren't likely to be publicised but it's good practice.

https://dev.twitch.tv/docs/eventsub#verify-a-signature