The /webhooks/sns endpoint was accepting bounce and complaint
notifications without verifying the AWS SNS cryptographic signature.
This allowed any authenticated user to forge reports for arbitrary
email addresses using their own valid :profile-identity token.
The fix adds:
- AWS SNS signature verification using RSA-SHA1
- URL validation for SigningCertURL and SubscribeURL (must be from
amazonaws.com domain)
- Proper logging of all verification failures with context fields
- Rejection of unverified messages before any processing
Closes#11092
AI-assisted-by: qwen3.7-plus
a8a441b7ad