`Utils::validateHmac` fails if the query params contains non url-safe characters.

Issue summary

Utils::validateHmac fails if the query params contains non url-safe characters. For example, for a oauth authorization callback, if the state is a base64-encoded string, the trailing = character will make the HMAC validation fail. After talking with the Shopify support, I was told that the HMAC sent from Shopify is computed based on the original query params, instead of the URL-encoded version.

Expected behavior

HMAC validation should still work if the HMAC comes for a URL containing encoded characters

Actual behavior

Utils::validateHmac returns false, even if I can manually confirm that the HMAC is correct

Steps to reproduce the problem

1. Initiate an OAuth autorization request. For the state, use non url-safe characters (i.e. JSON, Base64, or colons :). In my case, I use an app I'm developping, and requesting access for that app to a test shop.
2. When the autorization request is accepted, the user is redirected to your redirect_uri with the resulting query parameters. Save those for next step
3. use Utils::validateHmac to validate the callback. It will fail if the state indeed contains encoded characters.

Reduced test case

The best way to get your bug fixed is to provide a reduced test case.

Checklist

• I have described this issue in a way that is actionable (if possible)

Start at Utils::validateHmac and reproduce the OAuth callback with a state containing encoded characters such as Base64 or JSON. Trace how the callback query parameters are handled before HMAC validation; done means validation returns true for a correctly signed URL containing those characters.