docs: sign Digest header in hmac-auth body validation example

[CChongz1]

Description

Updates the hmac-auth body-validation example so that the generated Digest header is included in the HTTP signature.

Which issue(s) this PR fixes:

Fixes #13395

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes added
• I have added tests corresponding to this change (documentation-only change)
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible

[kayx23]

The Python generator now signs Digest, which is the right fix for #13395. The rest of the example still shows the old unsigned request, and the same example in the Chinese page is unchanged.

Please also update docs/zh/latest/plugins/hmac-auth.md (same Python snippet, printed headers, curl, and sample response). APISIX does not require en+zh in one PR, but this example is duplicated there and would otherwise keep the incomplete body-validation flow.

[kayx23]

This now produces headers="@request-target date digest", but the frozen sample output, success curl, and response body below still use headers="@request-target date" and signature="rjS6NxOBKmzS8CZL05uLiAfE16hXdIpMD/L/HukOTYE=".

For the documented timestamp Fri, 06 Sep 2024 09:16:16 GMT, the script prints:

headers="@request-target date digest"
signature="LGBTz7bVQQWlkijeyDpEwJWo+ppwX735uRZk5F8KhmU="

Please refresh those samples (issue item 4). A short note that validate_request_body only checks Digest against the body — and that signing digest is what binds the body to the HMAC — would also match the issue.