… (CHA-3071)

Adds two new helpers on `StreamChat::Client` so customers can ingest
gzip-compressed webhook payloads (and base64-wrapped SQS / SNS firehose
envelopes) without wiring `Zlib`, `Base64`, and `OpenSSL::HMAC`
together themselves:

* `decompress_webhook_body(body, content_encoding = nil, payload_encoding = nil)`
  - the primitive decoder, no signature check
* `verify_and_decode_webhook(body, x_signature, content_encoding = nil, payload_encoding = nil)`
  - decodes and timing-safely verifies the X-Signature HMAC against the
    uncompressed JSON, raising `StreamChat::WebhookSignatureError` on
    any failure (decode, decompress, or signature mismatch).

`nil` / empty for either encoding is a no-op, so the same handler keeps
working whether or not compression is enabled at the dashboard.

The existing `verify_webhook(body, x_signature)` boolean helper is left
untouched for backward compatibility.

Helper logic lives in `lib/stream-chat/webhook.rb` so the decode
primitives can be exercised independently. New tests in
`spec/webhook_compression_spec.rb` cover plain / gzip / base64 / base64
+ gzip round-trips, case-insensitive encoding values, every documented
unsupported encoding, malformed gzip / base64 input, and signature
mismatch scenarios (including signatures wrongly computed over the
compressed or wrapped bytes).

Docs: new "Compressed webhook bodies" section in the webhooks overview
with a Rails example and an SQS / SNS subsection that passes
`payload_encoding: 'base64'`.

Co-authored-by: Cursor <cursoragent@cursor.com>

Replaces verify_and_decode_webhook / decompress_webhook_body with the
cross-SDK contract documented at
https://getstream.io/chat/docs/node/webhooks_overview/.

Module-level helpers in StreamChat::Webhook:

  Primitives:
    ungzip_payload        - gzip magic-byte detection + inflate
    decode_sqs_payload    - base64 then ungzip-if-magic
    decode_sns_payload    - alias for decode_sqs_payload
    verify_signature      - constant-time HMAC-SHA256 comparison
                            (parameter order matches the cross-SDK spec)
    parse_event           - JSON -> Hash (typed event lands later)

  Composite (return parsed event Hash):
    verify_and_parse_webhook
    verify_and_parse_sqs
    verify_and_parse_sns

The composite functions auto-detect compression from body bytes, so
the same handler stays correct whether or not Stream is currently
compressing payloads, and behind middleware that auto-decompresses.

Client#verify_and_parse_{webhook,sqs,sns} mirror the three composite
helpers with the api_secret pulled from the client.

The legacy Client#verify_webhook(body, signature) -> bool helper is
kept for backward compatibility (now delegates to verify_signature).

Co-authored-by: Cursor <cursoragent@cursor.com>

RFC 1952 defines the gzip magic number as the two-byte sequence
1F 8B; the third byte (CM) is informational and not part of the
identifier. Trim the magic check from three bytes to two to match
the spec and stay consistent with the reference implementations
in the public docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

decode_sns_payload now JSON-parses the SNS HTTP notification envelope
({"Type":"Notification","Message":"..."}) and extracts the inner
Message field before running the SQS pipeline. Falls through to the
pre-extracted Message string when the input is not a JSON envelope so
existing call sites keep working.

Spec adds a realistic SNS HTTP notification body fixture and exercises
both the new envelope path and the existing pre-extracted Message path.

Co-authored-by: Cursor <cursoragent@cursor.com>

…den fixtures (CHA-3071)

Per Tommaso's suggestion, align the gzip helper with the GNU `gunzip`
command name. The function was added in this PR and not yet released,
so this is a straight rename with no back-compat alias.

Adds Tommaso's reference fixtures to the test suite as named cases so
future SDKs can sanity-check against the same payloads:

  aGVsbG93b3JsZA==                          -> helloworld   (base64)
  H4sIAGrYAWoAA8tIzcnJL88vykkBAK0g6/kKAAAA -> helloworld   (base64+gzip)

Co-authored-by: Cursor <cursoragent@cursor.com>