Signature validation should support validating with an old secret

Problem

Oauth2 signature validation will fail when during credential rotation, since the signature is generated with the oldest secret, and validation can only be configured to validate against a single secret in shopify_python_api.

Solution

This needs to be handled similar to webhook validation, where it must be possible to specify the old API secret as well as the new one for signature validation, and accept the signature if it matches the ones generated with either secret.

Issue 中没有指定文件或测试。首先定位现有的 OAuth2 签名验证入口点，并将其配置和行为与链接的 credential-rotation 文档中描述的 webhook 验证进行比较。完成标准是：验证能够接受使用当前或旧 API secret 生成的签名，同时保留当前单 secret 的行为。