Fix payment return forgery and release Odoo 18 security update

[orangebtc]

The public MakePay return route could process browser-supplied payment status under sudo and mark an unpaid Odoo transaction as confirmed. Make the return route redirect-only and require signed webhook reconciliation for payment state changes.

Preserve real confirmations by accepting MakePay's plain JSON deliveries and session.status=complete. Reject malformed webhook payloads and match paid event names exactly. Bump the Odoo 18 module to 18.0.1.0.1, document upgrade requirements and Odoo 18 support, and credit kta1kri for the private report.

Validation: python3 scripts/validate.py and git diff --check pass. All 10 Odoo 18 HTTP regression tests pass locally in PostgreSQL 16 and in GitHub Actions. Tests cover checkout rendering, forged returns, valid signed webhooks, invalid signatures, tampered bodies, malformed payloads, and state reconciliation. Running the return regression against the original revision reproduces an unpaid transaction changing from pending to done.

Payment-link creation is mocked in the checkout test; no real MakePay payment or customer deployment was used. This release supports Odoo 18 and requires the merchant's webhook URL and signing secret to be configured.

[orangebtc]

Thank you @kta1kri for privately finding and reporting this issue, and for suggesting the fix: keep the browser return route as a redirect and rely on signed webhooks to confirm payments. Your contribution helped us secure the MakePay Odoo plugin.

We have added @kta1kri to our bug bounty founders list. The current status of the future bounty program and the planned follow-up have been explained to him by email.

Public acknowledgement: #6.