* Drop dependency + use built-in `base64url`
[`create-hmac`](https://github.com/browserify/createHmac) is meant for compat between node and browser compat and was last updated in 2018.
Computing the HMAC signature on the client (browser) does not make any sense in 99% of the use-cases, as the secrets would be needed on the client side.
This means that we can drop browser support and just use the native node module, which is also exported by the `create-hmac` when running on node.
`Buffer.toString()` also accepts "base64url" as an encoding, so we can drop the `urlSafeBase64` in favor of that.
* Use encoder from hmac instance
Using `const createHmac = require('create-hmac')` will ensure that this script will work both on Node.js and Browser (otherwise it will crash on browser).
I've also updated `new Buffer` on line 7, which is deprecated in flavor of `Buffer.from`
