a8n: accept incoming BBS plugin webhook payloads
Created by: kzh
This PR is a preliminary piece of #6726 (closed). It registers a HTTP handler to accept incoming BBS plugin webhook payload requests and verify their HMAC signature.
This is a very rough PR. There is a bunch of duplicate code that can be modularized/abstractified. Down the line, more code hosts will be added. I'm not sure how the webhooks interfaces differ between future code hosts at the moment, so the code design isn't decided on yet. This will go through some refactoring/cleaning.