[IDEV-2586]: feat: add HMAC-SHA256 signing support for RTTF feed endpoints

[briluza]

Summary

• Enhancement: RTTF feeds now support HMAC-signed authentication.

  • All 9 feed methods (nod, nad, noh, domainrdap, domaindiscovery, realtime_domain_risk, domainhotlist, iphotlist, iprisk) previously raised ValueError when always_sign_api_key=True was set. They now sign the request using the same HMAC-SHA256 algorithm as standard API endpoints: HMAC-SHA256(key, username + timestamp + path).

• Fix: header_authentication auto-disables when HMAC signing is requested for RTTF. Previously, explicitly passing always_sign_api_key=True for an RTTF endpoint would leave header_authentication defaulting to True, causing both the X-Api-Key header and the HMAC query params to be applied simultaneously. The default is now resolved as is_rttf AND NOT always_sign_api_key, so requesting HMAC signing automatically disables header auth.

• Fix: RTTF path normalized before signing. RTTF paths are constructed without a leading slash (e.g. v1/feed/nod/), but the HMAC signing spec requires the version-prefixed path (e.g. /v1/feed/nod/). The path is now normalized with a leading / before the HMAC digest is computed, matching the behaviour of standard API paths.

• No change to defaults. Standard API endpoints continue to use HMAC signing by default (always_sign_api_key=True). RTTF endpoints continue to default to header authentication (X-Api-Key). HMAC for RTTF is opt-in via always_sign_api_key=True.

• Updated README.md

• Added examples/rttf_feeds.py. New example file demonstrating the four common RTTF patterns: basic stream, HMAC-signed stream, session-based stream, and download endpoint.

[cpanares]

Everything looks good! 💯