DXIM - Extension - improve action signature section

[JulienVerbrugge]

What changed

The ## Signature section was a single sentence with no actionable detail:

It's possible to configure a secret to sign the body of the POST request sent to the destination (SHA-512 protocol).

This PR replaces it with a complete implementation guide based on hands-on experience building a receiver for Action UI Extension calls.

What was added

• Header name and format: signature: sha512=<hex digest> — the header name was undocumented, which required reading third-party source code to discover.
• Step-by-step verification algorithm: capture raw body → compute HMAC-SHA512 → strip prefix → timing-safe compare.
• Warning about raw body capture: most frameworks parse the body before the handler runs; the docs now explain how to intercept bytes before that happens.
• Code examples in PHP, Node.js, and Python: each snippet shows both the verification function and the framework-specific raw-body capture pattern.
• Replay attack prevention: the timestamp field already documented in the payload section is now shown in action — how to reject requests older than 5 minutes.
• Secret rotation pattern: how to accept multiple secrets on the receiver side for zero-downtime key rotation.

Why this matters

Without these details, integrators have to either read the Symfony reference implementation or go back and forth with support to discover:

1. The header is called signature (not x-akeneo-signature or similar).
2. The value is prefixed with sha512=.
3. The raw body — not the serialised parsed object — must be signed.
4. Timing-safe comparison is required.

All four of these are non-obvious and caused real implementation friction.