use constant-time string compare for internal api authentication

Can't show this merge request because the source branch github/fork/Mic92/master is missing from project import-export-testing-group/gitlabhq_1662339666. Close this merge request or update the source branch.