Follows-up 4d9ccce.

The conditional call was overriden by the previous one.

* Add linting, testing, and CI workflow.
* Add docs.
* Add MIT license.
* Embed a copy of git-notifier from
  <https://github.com/scottgonzalez/node-github-notifier/blob/v2.1.0/index.js>.
  (To be simplified and developed further inside this repo.)
* Remove unused notify-mail code.

Ref jquery/infrastructure#526.

Ref jquery/infrastructure#526.

Follows-up 89ef2e8 and 8925c9b, based on Ori's code review:

* Remove `owner.name` .
  Property `owner.login` is documented and was consistently present in
  events I inspected. The other should be redundant as such. It was
  also not documented at [1], and not present in any events.

* Validate `data.ref` before slicing the string for use in `event.postfix`.

* Use RegExp#test instead of exec for simple boolean check.

* Use path.join() instead of concatenating with slash.

* Switch from unmaintained "optimist" package to commander.js,
  and validate port and directory options.

* Limit HTTP payload size.

* Document HTTP timeouts.

[1] https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads

This was a needlessly breaking change that made it rather
difficult to upgrade servers in-place. Let's undo that.

<https://github.com/caolan/async>

This skips over async 2.x, which carried an additional dependency
on Lodash that has since been dropped. The latest version still
advertises support for Node 6+, so it should work with Node 10+ as
well. Recent releases do include ES2020 support for async/await,
but appears to be done based purely through Promise and then-able
interface in a way that the library itself remains ES6-compatible
(no actual 'async' or 'await' statements internally).

When deploying changes to large static sites, even relatively
small changes where each of the many pages changes a little,
GitHub details the names of every file in the "push" event.

Ref jquery/infrastructure-puppet#10.

These events exceed the size of MAX_BODY_LENGTH. Remove this
restriction but preserve its spirit (not parsing large sequences
of malicious JSON) by validating the HMAC signature *before* parsing
the payload.

For this to be consistent, the support for the "urlencoded" format
is removed because that format required parsing before the "payload"
is known, and thus required parsing before one could validate the
payload. This way, we don't leave the door open to malicious requests
that still invoke `querystring.parse()`.

Reduce chances of misconfiguration by explicilty refusing to
start without a secret for payload verification, unless it is
explicitly disabled.

Credit to Quarkslab for the discovery and recommended mitigation.

Ref jquery/infrastructure#526
Ref jquery/infrastructure#565
Closes jquery#1

Follows-up 0e9aa90 which introduced MAX_BODY_LENGTH,
and fec6bd9 which removed it again due to being too low for static
site deployments where small changes often change all files and thus
produce fairly large GitHub Push eventsm because they are essentially
a JSON wrapper around `git show` with a full file listing.

GitHub Docs promise to limit the 'added', 'removed', and 'changed'
arrays to 5000 file paths each (if more, the array is capped, in favor
of recommending you call their API for the full details instead), or
25 MB overall (event is dropped by them if still larger than that).

Note that we don't need any of this information, but there's no way
to opt-out of this afaik.

Note that we did not actually remove the limit in that patch in
practice, because we run it with Nginx in front, and that limits the
request body to 1MiB. That has been large enough so reflect that in
the Node.js service directly as well, to benefit other potential users
of the package.

Credit to Quarkslab for the discovery and recommended mitigation.

Ref jquery/infrastructure#565.

Add missing "error" handler which was exposed by a change in behavior
in Node.js 24.16.x, where `http.request` now also emits an error
(ECONNRESET) after having received the HTTP 413 response. This then
became a global uncaught error due to the missing "error" handler.

Adding `req.on('error', reject);` is a no-op because the Promise is
already settled by `resolve()`, so it's still ignored all the same
but in user-land rather than somewhere internally.

See also nodejs/node#64272

Ref jquery/infrastructure-puppet#91