fix(payments-next): [f006] CMS webhook secret length leaked via timingSafeEqual exception

[elizabeth-ilina]

Because

• No length pre-check in verifyWebhookSignature let an attacker learn the secret's byte-length by observing 500 vs 200 responses.
• Auth failures returned 200 {success:true}

This pull request

• Makes handleValidationWebhook return 401 on auth failure instead of silently returning 200.
• Note: the length check was implemented in the PR for PAY-3780, here

Issue that this pull request solves

Closes: #PAY-3799

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on:
• Suggested review order:
• Risky or complex parts:

Screenshots (Optional)

Other information (Optional)

Any other information that is important to this pull request.