use separate secret for lti postMessage forwarding

why:
* the standard services secret is different in each region,
meaning that using it for postMessage forwarding
for LTI Platform Storage would not work when the
school was in a different region than sso.canvaslms.com

closes INTEROP-8191
flag=lti_platform_storage

test plan:
* cp config/vault_contents.yml.example config/vault_contents.yml
* dc restart to pick up config file changes
* in a rails console, confirm `Lti::PlatformStorage.signing_secret`
has a value

Change-Id: I7b361dc615316883f86f00de721fa19b7a12e774
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/324663
Reviewed-by: Ryan Hawkins <ryan.hawkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Tucker Mcknight <tmcknight@instructure.com>
Product-Review: Xander Moffatt <xmoffatt@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>

app/controllers/lti/platform_storage_controller.rb

@@ -115,7 +115,7 @@ module Lti
     end
 
     def signing_secret
-      CanvasSecurity.services_signing_secret
+      Lti::PlatformStorage.signing_secret
     end
   end
 end

config/vault_contents.yml.example

@@ -19,6 +19,8 @@ development:
       canvas_security:
         encryption_secret: "astringthatisactually32byteslong"
         signing_secret: "astringthatisactually32byteslong"
+      lti_platform_storage:
+        signing_secret: "astringthatisactually32byteslong"
 #      canvas_cdn_creds:
 #        aws_access_key_id: <access_key_id>
 #        aws_secret_access_key: <secret_access_key>

lib/lti/platform_storage.rb

@@ -38,5 +38,9 @@ module Lti
     def self.flag_enabled?
       Account.site_admin.feature_enabled?(:lti_platform_storage)
     end
+
+    def self.signing_secret
+      Rails.application&.credentials&.dig(:lti_platform_storage, :signing_secret)
+    end
   end
 end

spec/lib/lti/platform_storage_spec.rb

@@ -62,4 +62,19 @@ describe Lti::PlatformStorage do
       end
     end
   end
+
+  describe "::signing_secret" do
+    subject { Lti::PlatformStorage.signing_secret }
+
+    let(:signing_secret) { "sekret" }
+
+    before do
+      allow(Rails).to receive(:application).and_return(instance_double("Rails::Application", credentials: {})) unless Rails.application.present?
+      allow(Rails.application.credentials).to receive(:dig).with(:lti_platform_storage, :signing_secret).and_return(signing_secret)
+    end
+
+    it "should return value from vault" do
+      expect(subject).to eq signing_secret
+    end
+  end
 end