feat(signature): add a freshness and coverage policy for incoming signatures

Signature.check_signature_policy/2 requires date or (created) to be
signed and within signature_max_age (2 h) / signature_max_clock_skew
(1 h), and requires a signed, hashed digest for requests with a body.

Based on Akkoma's http_signatures fork (required headers, max_sig_age)
and Mastodon's SignedRequest (clock skew margin).

config/description.exs

@@ -1788,6 +1788,27 @@ config :pleroma, :config_description, [
         description:
           "List of IPs (CIDR format accepted) to exempt from HTTP Signatures requirement (for example to allow debugging, you shouldn't otherwise need this)"
       },
+      %{
+        key: :signature_policy,
+        type: {:dropdown, :atom},
+        description:
+          "What to do with incoming HTTP signatures that do not sign the date (or `(created)`), are outside the allowed time window, or do not sign the digest of a request body. `:enforce` treats them as invalid, `:log` only logs them",
+        suggestions: [:enforce, :log]
+      },
+      %{
+        key: :signature_max_age,
+        type: :integer,
+        description:
+          "How old, in seconds, the signed date of an incoming HTTP signature can be. Default: 7200 (2 hours)",
+        suggestions: [7200]
+      },
+      %{
+        key: :signature_max_clock_skew,
+        type: :integer,
+        description:
+          "How far, in seconds, the signed date of an incoming HTTP signature can be in the future. Default: 3600 (1 hour). A `(created)` time in the future is always rejected",
+        suggestions: [3600]
+      },
       %{
         key: :note_replies_output_limit,
         type: :integer,