feat: HMAC verification for web widget (#1643)

* feat: HMAC verification for web widget. Let you verify the authenticated contact via HMAC on the web widget to prevent data tampering.
* Add docs for identity-validation

Co-authored-by: Pranav Raj S <pranav@chatwoot.com>

app/controllers/api/v1/widget/base_controller.rb

@@ -7,7 +7,12 @@ class Api::V1::Widget::BaseController < ApplicationController
   private
 
   def conversations
-    @conversations = @contact_inbox.conversations.where(inbox_id: auth_token_params[:inbox_id])
+    if @contact_inbox.hmac_verified?
+      verified_contact_inbox_ids = @contact.contact_inboxes.where(inbox_id: auth_token_params[:inbox_id], hmac_verified: true).map(&:id)
+      @conversations = @contact.conversations.where(contact_inbox_id: verified_contact_inbox_ids)
+    else
+      @conversations = @contact_inbox.conversations.where(inbox_id: auth_token_params[:inbox_id])
+    end
   end
 
   def conversation