Verify Sanity webhook signatures in the revalidate route

The secret was passed in the query string, which ends up in access logs
and doesn't protect the request body. Verify the signed header with
@sanity/webhook instead, and return 400 for invalid JSON.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

package.json

@@ -15,6 +15,7 @@
     "@portabletext/react": "^3.2.1",
     "@sanity/client": "^7.8.1",
     "@sanity/image-url": "^1.1.0",
+    "@sanity/webhook": "^4.0.4",
     "country-flag-icons": "^1.5.19",
     "install": "^0.13.0",
     "next": "^16.3.3",