fix: address CodeRabbit security and documentation feedback

- Use crypto/subtle.ConstantTimeCompare for webhook secret validation
  to prevent timing attacks
- Fix test script usage comment to match actual filename

Signed-off-by: Tanjim Hossain <[email protected]>

Author: audacioustux

config/examples/cloudevents/test-webhook.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 # Test script for CloudEvents webhook
-# Usage: ./test-cloudevents-webhook.sh <webhook-url> <secret>
+# Usage: ./test-webhook.sh <webhook-url> <secret>
 
 set -e
 

pkg/webhook/cloudevents.go

@@ -1,6 +1,7 @@
 package webhook
 
 import (
+	"crypto/subtle"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -63,7 +64,7 @@ func (c *CloudEventsWebhook) Validate(r *http.Request) error {
 			return fmt.Errorf("missing webhook secret")
 		}
 
-		if secret != c.secret {
+		if subtle.ConstantTimeCompare([]byte(secret), []byte(c.secret)) != 1 {
 			return fmt.Errorf("invalid webhook secret")
 		}
 	}