Remove inbound request signature verification (closes #279)

The receiver verified an optional per-entrypoint HMAC or shared token
before accepting a request. That is removed outright: the entrypoint
UUID in the URL is the authentication secret, and possession of it
authorises submission. This reverses the feature added in fcead5d.

Deletes the internal/signature package, the signature_scheme and
signature_secret columns from Entrypoint along with their accessors,
the per-entrypoint secret form and its POST route, and the scheme
labelling in EntrypointView. Pre-1.0 with no installed base, so the
columns simply stop being written; there is no migration and no
compatibility path.

Header sanitisation goes with it. SanitizeHeaders existed to strip a
scheme's own credential header before the header map was stored and
forwarded; with no configured credential there is nothing to strip, so
the receiver marshals the headers as received.

The receiver's other protections are untouched: the 1 MB body cap, the
per-IP rate limiter, the 410 for a deactivated entrypoint and the 404
for an unknown UUID.

internal/database/model_secrets_test.go

@@ -34,8 +34,6 @@ func marshalModel(t *testing.T, v any) string {
 //   - APIKey.Key is a bearer token outright.
 //   - Setting.Value holds the session encryption key.
 //   - User.Password holds the Argon2 hash, and was already tagged.
-//   - Entrypoint.SignatureSecret is the secret its senders sign with,
-//     stored in the clear because HMAC verification needs the key.
 func TestModelsDoNotMarshalTheirSecrets(t *testing.T) {
 	t.Parallel()
 
@@ -74,14 +72,6 @@ func TestModelsDoNotMarshalTheirSecrets(t *testing.T) {
 				Password: marker,
 			},
 		},
-		{
-			name: "entrypoint signature secret",
-			model: database.Entrypoint{
-				Description:     keptField,
-				SignatureScheme: database.SignatureSchemeGitHub,
-				SignatureSecret: marker,
-			},
-		},
 	}
 
 	for _, tc := range cases {
@@ -115,24 +105,3 @@ func TestWebhookMarshalsNoTargetConfig(t *testing.T) {
 	assert.NotContains(t, encoded, marker)
 	assert.Contains(t, encoded, keptField)
 }
-
-// TestWebhookMarshalsNoEntrypointSecret covers the same nested case
-// for the entrypoint's inbound signature secret, which reaches a
-// marshalled webhook through the Entrypoints association.
-func TestWebhookMarshalsNoEntrypointSecret(t *testing.T) {
-	t.Parallel()
-
-	const marker = "QQENTRYPOINTMARKERQQ"
-
-	encoded := marshalModel(t, database.Webhook{
-		Name: keptField,
-		Entrypoints: []database.Entrypoint{{
-			Path:            "some-uuid",
-			SignatureScheme: database.SignatureSchemeGitLab,
-			SignatureSecret: marker,
-		}},
-	})
-
-	assert.NotContains(t, encoded, marker)
-	assert.Contains(t, encoded, keptField)
-}