[JENKINS-74983] Add support for authenticated Webhooks registered in Bitbucket

[nfalco79]

Add signature check in the webhooks processor.

Since development teams are not responsible for security, otherwise one project might enforce security and another might not, the admin should constantly check that all projects have the correct configuration.
For this reason it must be enabled for all or none. Another consideration is that the webhook is configured globally. Users can disable it for a specific project and manage it manually, but this means that if disabled, the global secret key must still be used.

The secret is not customisable by single project for the following reasons:

• events should contains a duplicate of the payload to be verified only in BitbucketSCMSource.retrieve method.
• that means spend a lot of resources just to ignore the payload. Multiple fake requests, would overload Jenkins that have to process events to lookup the right project.
• could not response to Bitbucket that the payload is invalid because events are managed async.
• each event could serve multiple projects that potentially could be configured with a different secret.

[nfalco79]

@KalleOlaviNiemitalo any idea where I can find the API Documentation to register a webhook secret for the "Jenkins and Azure DevOps Post Webhooks for Bitbucket"?

[KalleOlaviNiemitalo]

I don't know whether "Jenkins and Azure DevOps Post Webhooks for Bitbucket" supports HMAC signatures in webhook requests. https://help.moveworkforward.com/BPW/how-to-choose-an-authentication-type lists only Basic, Bearer, and Kerberos authentication. https://help.moveworkforward.com/BPW/how-to-create-a-new-webhook and https://help.moveworkforward.com/BPW/how-to-manage-configurations-using-post-webhooks-f don't seem to mention a setting for the HMAC key.