Fix UTF-8 confusion in HMAC check

The current code for comparing HMACs confuses byte strings with UTF-8. Any UTF-8 errors turn into U+FFFD REPLACEMENT CHARACTER. The bits behind those errors would then not contribute to the integrity check.

This adds a test that tickles this case and fixes the comparison. It also hopefully better avoids timing problems. I don't really know much about crypto code, but I think this is what a constant-time compare usually looks like? Really this should be in C though. I don't know if any optimizations V8 does here would cause troubles.