[REST] secret must be optional in a Subscription

[jmcanterafonseca-iota]

as there could be asymmetric cryptography used where no secret is needed

[mgh128]

Option client request (in payload): signatureToken (primarily used for symmetric signatures such as HMAC-SHA256) Server response to webhook calls: GS1-signature

Add examples in OpenAPI spec for both symmetric and asymmetric signatures

[domguinard]

Done