chore: use string-timing-safe-equal package

chore: use string-timing-safe-equal package #2506