Security: Use constant-time comparison for HMAC verification

[nomadium]

Fix potential timing attack vulnerability in HMAC signature verification.

The previous implementation used Ruby's == operator for comparing signatures:

signature == sign(data)

This is vulnerable to timing attacks because == performs byte-by-byte comparison and returns false as soon as it finds a mismatch. An attacker can measure response times to determine how many leading bytes of their forged signature match the valid signature, potentially allowing them to construct a valid signature over many requests.

The fix uses OpenSSL.secure_compare which performs constant-time comparison:

OpenSSL.secure_compare(signature, sign(data))

This always takes the same amount of time regardless of where (or if) the strings differ, preventing timing-based information leakage.

Changes:

• Replace == with OpenSSL.secure_compare in HMAC::Key#verify
• Add tests verifying the secure comparison is used
• Add tests for various HMAC verification scenarios

Security Impact:

• Mitigates CWE-208: Observable Timing Discrepancy
• No functional changes to signature verification behavior
• Compatible with existing OpenSSL >= 3.0 requirement

References:

• https://cwe.mitre.org/data/definitions/208.html
• https://codahale.com/a-lesson-in-timing-attacks/