Update http-signature to prevent timing attacks

[dotchev]

Fixes #1388

Affected versions of the package are vulnerable to Timing Attacks due to time-variable comparison of signatures. A malicious user can guess a valid signature one char at a time by considering the time it takes a signature validation to fail.

https://snyk.io/vuln/npm:http-signature:20150122

[retrohacker]

Failing tests are Node.js v8 specific, merging.

Thanks for the PR @dotchev ❤️