fix: reject malformed and future webhook timestamps

[flcrom]

Fixes #1698.

verifyHeader only rejected timestamps that were too old, so a future-dated header passed. It now compares the absolute difference against the tolerance, and rejects a t= value that isn't a plain integer (before, parseInt returned NaN for junk and every comparison with it was false).

The WorkOS docs say the timestamp is milliseconds since the epoch (https://workos.com/docs/webhooks), which is what the check compares. Three spec fixtures built their timestamp as Date.now() * 1000, microseconds, so I changed them to Date.now() to match the docs.

Added tests for malformed values and for offsets just inside and just outside the tolerance. Ran the full suite on Node 22 and 24 locally.

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge.

Summary

verifyHeader now rejects malformed timestamps and timestamps outside the allowed window in either direction.

• Webhook signatures reject bad timestamps and check both time directions.

_{Reviews (1) · Last reviewed commit: "fix: reject malformed and future webhook..." · Reviewed by Greptile}