README: add a 'Testing your callback endpoint' section

[loevgaard]

Follow-up to the CallbackValidator/CallbackHandler design discussion: the classes deliberately have no interfaces and are final, which means consumers cannot mock them — and shouldn't. This section documents the intended pattern instead:

• use a real CallbackHandler with a made-up test key (verification is deterministic, no I/O)
• forge authentic signatures with $handler->validator()->sign($body) — this is the reason validator() is public, and it's the same pattern the SDK's own test suite uses
• why mocking would be counterproductive: the checksum is over the raw byte-for-byte body, and the most common callback bug (a framework decoding/re-encoding or consuming the body before verification) is only caught by a real round-trip
• includes the rejection-path example (tampered body → InvalidChecksumException)

Docs only — no code changes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.50%. Comparing base (425bd28) to head (cac9f18).

Additional details and impacted files

@@            Coverage Diff            @@
##                1.x       #7   +/-   ##
=========================================
  Coverage     98.50%   98.50%           
  Complexity      146      146           
=========================================
  Files            24       24           
  Lines           401      401           
=========================================
  Hits            395      395           
  Misses            6        6           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.