Add a (failing) test for tampered HMACs

The test input conveniently chosen so that the HMAC (mis-)interpreted as UTF-8
gives REPLACEMENT CHARACTER (U+FFFD) at the end.
Check HMACs better

Makes the previous test pass. The previous version incorrectly treated the HMAC
as a UTF-8 which loses bits to replacement characters. Also, make some attempt
to check it in constant-time. Ideally node would provide a native
implementation less sensitive to the JS implementation.