Function validateGraphNotification

Performs the Graph change-notification gate, pure + exported so the MJAPI router calls it on every POST /meetings/teams/notifications request (these can't carry an MJ JWT — the handshake + clientState shared secret are the gate):

1. If the request carries a validationToken query param, it's the subscription-validation handshake → return { Kind: 'validation', ValidationToken } (the router echoes it back as text/plain 200). A blank token rejects.
2. Otherwise it's a real notification. Every notification in the batch carries a clientState; verify each (constant-time) against the secret we set when creating the subscription. Any mismatch rejects the whole batch (an attacker who can't produce the secret must not drive bot behavior).