feat: ESSR protected client APIs

[iFergal]

This replaces the current RFC-9421 signed headers between Signify and KERIA with ESSR. Beyond confidentiality, it also resolves other issues from before such as unsigned query params and bodies. (#287)

The unsigned HTTP request from the client is converted to a HTTP bytestream and embedded in an ESSR payload. This payload becomes the body of a wrapper HTTP request for the "/" path - so tunneled via ESSR. The wrapper could be handled by pure TCP but for now this works quite nicely in the Falcon middlewares with minimal changes.

Like the keripy ESSR parser, the commitment to unsigned HTTP request is done by taking a digest:

payload = dict(
    src=<sender>,
    dest=<receiver>,
    d=coring.Diger(ser=cipher, code=MtrDex.Blake3_256).qb64,
    dt=dt,
)

I have written the corresponding code in Signify and all integration tests pass. I will create a Signify PR tomorrow. They should probably merge together.

[iFergal]

WebOfTrust/signify-ts#304 created on Signify side

[2byrds]

why does it need this replacement, is it a fix for another issue with the headers we're producing/receiving?

[iFergal]

It's how WSGI (falcon) expects it in the environ that builds the request. The headers in the actual HTTP request still have dashes like normal.

hio also does it: https://github.com/ioflo/hio/blob/main/src/hio/core/http/serving.py#L737-L740