Improve webhook signature validation

[vtlxx]

Why?

This update clarifies a non-obvious behavior in WebhookSignature::verifyHeader. Previously, it was not clear from the docblock that timestamp validation is skipped not only when tolerance is null, but also when 0 is passed. Since the actual check only runs when $tolerance > 0, passing 0 effectively disables tolerance validation.

The signature header parsing logic previously relied on implicit assumptions about the header format. By explicitly validating key=value pairs, the code now safely ignores malformed values (e.g. t, v1) that would previously throw exceptions, instead of attempting to process them.

What?

• Clarify in the WebhookSignature::verifyHeader docblock that timestamp validation is skipped when tolerance is null or 0
• Add an explicit 2 === \count($itemParts) check in WebhookSignature::getTimestamp to safely ignore malformed header parts (e.g. t, v1) and prevent exceptions
• Add the same 2 === \count($itemParts) check in WebhookSignature::getSignatures

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[prathmesh-stripe]

Is there a case when you receive a malformed values from Stripe?
I'm not sure if we would want to ignore a case without throwing an exception when we receive a malformed value. SDK should throw the exception(maybe a better one) and give the user the choice to catch/ignore it.