Youtube Websub Verify

Echo hub.challenge so Google can confirm subscribe/unsubscribe.

This endpoint is unauthenticated by necessity, and both the callback URL and YouTube channel ids are public, so every field here is attacker controlled. A verification is only applied when it matches an operation we actually requested against the topic we actually subscribed to.