[php-src] Issue #8462: RFE: make hash_equals() more safe against timing attacks

Issue: https://github.com/php/php-src/issues/8462 Comment Author: nikic This has been discussed extensively in the past and declined. The tl;dr is that it is essentially impossible to not leak information about the length, and we prefer to be honest about this, rather than implementing partial mitigation. Additionally, this guarantee is generally not useful in practice -- the string length of the secret is generally part of the cryptographic construction, and security cannot depend on it being known to the adversary. See https://github.com/php/php-src/pull/792 for one of the related discussions.