Signature validation should support validating with an old secret

Problem

Oauth2 signature validation will fail when during credential rotation, since the signature is generated with the oldest secret, and validation can only be configured to validate against a single secret in shopify_python_api.

Solution

This needs to be handled similar to webhook validation, where it must be possible to specify the old API secret as well as the new one for signature validation, and accept the signature if it matches the ones generated with either secret.

Issue 中沒有指定檔案或測試。首先定位現有的 OAuth2 簽章驗證進入點，並將其設定與行為和連結的 credential-rotation 文件中所描述的 webhook 驗證進行比較。完成標準是：驗證能接受使用目前或舊的 API secret 產生的簽章，同時保留目前單一 secret 的行為。