fix: return verified boolean in verify_signature, prevent timing attacks, and ensure thread-safe headers

[cobanfurkanx]

Summary

This PR addresses several critical reliability, security, and concurrency issues in IyzipayResource:

1. verify_signature returned None: The method computed verified = signature == calculated_signature and printed it to stdout, but never returned the boolean, causing any caller performing if not payment.verify_signature(...) to always fail even on valid signatures.
2. Timing Attack Vulnerability: Replaced standard string equality comparison with constant-time hmac.compare_digest to protect against HMAC timing side-channel attacks.
3. TypeError in calculate_hmac_sha256_signature: When params contained numbers (paidPrice, price, installment) or None (conversationId), ':'.join(params) raised TypeError: sequence item X: expected str instance. It now safely converts values to string or empty string.
4. Multi-threading Race Condition on header (Addresses Bugs I experienced & Concept (FastAPI, MongoDB, React) #91): IyzipayResource.header was a shared class variable mutated in-place during each request (self.header.update({'x-iyzi-rnd': ...})). In concurrent environments (e.g. FastAPI / Django / Flask with threaded workers), concurrent requests could overwrite headers mid-flight, causing Geçersiz imza authentication failures. Headers are now copied per-request.
5. base_url Host Sanitization: Gracefully handles both scheme-less hostnames (sandbox-api.iyzipay.com) and standard URLs (https://sandbox-api.iyzipay.com), preventing InvalidURL: nonnumeric port errors.
6. Automated Unit Tests & CI Execution: Added a unit test suite in tests/ and updated .github/workflows/github_pull_request.yml to run automated test discovery across the matrix (Python 3.9–3.13).

Verification

All 14 unit tests pass cleanly:

$ python -m unittest discover -s tests -v
Ran 14 tests in 0.028s
OK