Secure Webhooks

**Overview**
Secure webhook endpoints coming from known sources such as Typeform or MongoDB

**Details**
This issue will focus specifically on securing the endpoint that is accepting information from Typeform. Completing this will allow for us to easily replicate similar logic for data coming from different sources. The need to secure these endpoints is because our current setup involves exposed webhooks that can potentially receive invalid or malicious requests. Full details on how to secure the endpoints are listed below. Refer to the following sources for the content on how to go about it

- [Typeform Webhook Docs](https://developer.typeform.com/webhooks/secure-your-webhooks/)
- [Express Implementation](https://stackoverflow.com/questions/56149652/validate-typeform-webhook-payload-in-node)

**Task List**
- [x] Create dedicated middleware / express server to handle the typeform webhook endpoint
- [x] Validate `Typeform-Signature` header by generating same sha256 signature
- [x] Generate new secret to use and save it to the Firebase Functions Environment variables. Quick command -> `firebase functions:config:set Typeform.Secret=abc`
- [x] Archive firestore triggers for functions that were dependant on Typeform data but will no longer run in any useful setting (eg. Hacktoberfest)
- [x] Document secret to be used in Typeform in a secure location

Start with the Firebase Functions entrypoint handling Typeform webhooks and any Express router, then trace existing Typeform webhook handlers and Typeform-linked Firestore triggers. Find where function config/environment values are loaded, and place `Typeform-Signature` verification before request processing. Add or update docs describing where the secret is stored and how Typeform is configured. Done means unsigned Typeform calls are rejected, old Typeform triggers are archived or disabled, and docs include the Firebase secret setup.

Escrita pelo modelo de indexação a partir do texto da issue.