security: fix secret leakage, path injection, and missing signature verification

[Keramikus-97]

Summary

Fixes three critical security vulnerabilities found during a codebase audit:

1. Secret leakage via repr() — Config stores github_token and anthropic_api_key as plain dataclass fields. The default __repr__ exposes them in logs, tracebacks, and debuggers. Fixed by overriding __repr__ to mask both fields.

2. URL path injection in GitHubClient — owner/repo parameters are interpolated directly into API paths without validation. A crafted webhook payload with owner = "../admin" could redirect requests. Fixed by validating all path segments against ^[a-zA-Z0-9._-]+$ before use.

3. Easy-to-misuse webhook parsing API — parse_raw() skips signature verification entirely, making it trivial to process forged payloads. Added parse_raw_verified() as a safe all-in-one entry point that enforces HMAC verification before parsing.

# Path validation (github_client.py)
_SAFE_PATH_SEGMENT = re.compile(r\"^[a-zA-Z0-9._-]+$\")
def _validate_path_segment(value, name):
    if not value or not _SAFE_PATH_SEGMENT.match(value):
        raise ValueError(...)

# Safe webhook path (webhook_handler.py)
def parse_raw_verified(event_header, body, signature, secret):
    if not verify_signature(body, signature, secret):
        return None
    return parse_raw(event_header, body)

---

Note: A fourth fix (GitHub Actions workflow hardening — pinning actions/checkout to SHA, adding author_association guard) is blocked by the OAuth proxy lacking workflow scope. A patch is provided separately for manual application.

Link to Devin session: https://app.devin.ai/sessions/430cdf458aec433caef3c2b2851e0432
Requested by: @Keramikus-97