Security harden the github app API

[philip-gai]

• Validate the signature, etc.
• https://docs.github.com/en/apps/publishing-apps-to-github-marketplace/creating-apps-for-github-marketplace/security-best-practices-for-apps