Implement RFC 9421 HTTP Message Signatures

Requirements

• Is this a feature request? For questions or discussions use https://lemmy.ml/c/lemmy_support or the matrix chat.
• Did you check to see if this issue already exists?
• Is this only a feature request? Do not put multiple feature requests in one issue.
• Is this a backend issue? Use the lemmy-ui repo for UI / frontend issues.
• Do you agree to follow the rules in our Code of Conduct?

Is your proposal related to a problem?

I'm tracking implementation of RFC 9421, HTTP Message Signatures, in Fediverse software. Developers are moving away from the interim draft version, draft-cavage-12, to the final version of the spec. It would be great for lemmy to support the new spec.

Describe the solution you'd like.

To support the RFC, lemmy needs to do 4 things:

[ ] Accept RFC 9421 signatures for incoming GET requests (object, actor, collection, ...) [ ] Accept RFC 9421 signatures for incoming POST requests (inbox, sharedInbox) [ ] Send RFC 9421 signatures for outgoing GET requests [ ] Send RFC 9421 signatures for outgoing POST requests

There are still too many servers on the Fediverse that only support draft-cavage-12 to support the new version only (unless you want to cut out a lot of potential users). But it's possible to support both versions. For accepting signatures, RFC 9421 has a second header, Signature-Input, so you can key which kind of signature you're getting based on the presence of that header.

For sending signed requests, it's not easy to know which signature format the remote server supports. One trick is "double knocking" -- trying one version, and if it fails, trying the others. FEP 844e provides a mechanism for a server to declare its support.

Describe alternatives you've considered.

It's also possible to just stay on draft-cavage-12 forever. At some point, other platforms will start to drop their support for this version, though.

Additional context

No response