When doing RPC requests we should have authentication on requests. I've
gone with a simple request signature HMAC verfication as it felt like
the simplest solution that was tamper & forgery resistant. Previously
we had planned on using mTLS as authentication between regions. Setting
up a cerfiticate authority and managing certificates is more scope than
we presently have capacity for.

I'm anticipating us needing to do key rotation, or signature upgrades in
the future and have accounted for both in the current design.

Refs HC-730

Using requests lets us use responses for mocks which is more consistent
with other network stubs that we have in the application.