Use signed timestamp for nonce

[paulwe]

Description

implements nonce generation using the method from chromium (https://source.chromium.org/chromium/chromium/src/+/main:third_party/webrtc/p2p/base/turn_server.cc;l=385;drc=8e78783dc1f7007bad46d657c9f332614e240fd8?q=turn_server.cc). create a random hmac and use it to hash the timestamp of the authentication request. validate by checking the hash and time elapsed since the nonce was generated.

Reference issue

Fixes #361

[boks1971]

LGTM!

[boks1971]

Not sure if Pion linter complains, maybe name the variable n to follow the convention of first letter of type?

[rg0now]

Looks good to me too.

One minor (and probably insignificant) point: the signature of server.Request changes, I'm wondering whether this is public API. I'd say no, but the line between what's public and what's not is really fuzzy in Go.

[paulwe]

server.Request is part of an internal package so it can't be imported by other packages.

[codecov]

Codecov Report

Attention: 22 lines in your changes are missing coverage. Please review.

Comparison is base (a980322) 67.31% compared to head (49ee185) 66.46%.

Files	Patch %	Lines
internal/server/nonce.go	45.45%	12 Missing and 6 partials ⚠️
server.go	50.00%	2 Missing and 1 partial ⚠️
internal/server/util.go	50.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #371      +/-   ##
==========================================
- Coverage   67.31%   66.46%   -0.85%     
==========================================
  Files          42       43       +1     
  Lines        2848     2860      +12     
==========================================
- Hits         1917     1901      -16     
- Misses        769      793      +24     
- Partials      162      166       +4     

Flag	Coverage Δ
go	66.46% <46.34%> (-0.85%)	⬇️
wasm	38.67% <42.85%> (-9.96%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.