Handle signed webhook challenges before event-only checks
A webhook challenge must be handled before checks that apply only to event callbacks. A provider may omit workspace or channel fields from its URL-verification payload, even when later events carry them. Verify the challenge request's signature first, return its challenge, and ke…