Stripe webhooks on Rails: verify request.raw_post and skip forgery protection

# Stripe webhooks on Rails

Two Rails defaults break Stripe webhooks: `protect_from_forgery` rejects the POST with no authenticity token, and `params` gives you parsed data. Skip forgery protection for the webhook action and verify `request.raw_post`.

## The setup

```
class WebhooksController < ApplicationController
  skip_before_action :verify_authenticity_token, only: [:stripe]

  def stripe
    payload = request.raw_post
    sig = request.headers['Stripe-Signature']
    begin
      event = Stripe::Webhook.construct_event(
        payload, sig, ENV['STRIPE_WEBHOOK_SIGNING_VALUE']
      )
    rescue Stripe::SignatureVerificationError, JSON::ParserError
      return head :bad_request
    end
    # case event.type ...
    head :ok
  end
end
```

```
post '/webhooks/stripe', to: 'webhooks#stripe'
```

## Notes

- Scope the skip to the webhook action only, never the whole controller.
- `request.raw_post` returns the unparsed body string; `params` is already parsed and will fail verification.
- Rescue `JSON::ParserError` too: a garbage body should be a 400, not a 500.